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EFFECTIVE: 08/28/91 



23-6.12.3 Other 



Even though RFPA has no criminal sanctions, customer 
records covered by RFPA would also be covered by the Privacy Act of 
iy/4 which does provide for criminal penalties. 



MIZCJIVE:_08j [28/9JL 



23-6.13 



G 



Cost Reimbursement 



DE . n4 (1) Generally, for all customer records obtained by the 
RFPA access methods, the financial institution must be reimbursed 
starting 10/1/79 for such records at a rate established by the 
Governors of the Federal Reserve System. 

(2) Reimbursement should be accomplished through the 
routine commercial vouchering procedures (MAOP, Part II 6-9) 
Financial institutions should be encouraged to submit an invoice to 

It* P- 6 ^ °«' Ce " Verin « the cost of obtaining the customer records. 

|lne field office draft system | should not be routinely used to 
reimburse financial institutions. 



s 



EFFECTIVE: 12/07/93 



23 6.14 Reporting Requirements 



EFFECTIVE: 08/28/91 



23-6.14.1 Dissemination of Information Obtained (See MAOP. Part II 
9-10 and MIOG, Part II, 23-6.11) 



EFFECTIVE: 08/28/91 
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| Pursuant to the terms of the RFPA within the Federal 
Reports Elimination and Sunset Act of 1995, each field division will 
no longer be required to compile annual RFPA statistics for submission 
to FBIHQ and Congress. 



EFFECTIVE: 06/11/96 



23-7 



INTERNATIONAL CRIMINAL POLICE ORGANIZATION (INTERPOL) 
|See Part I, Section 163-10, of this manual. I 



Q 



EFFECTIVE: 10/18/88 

23-8 TRAVEL - INVESTIGATIVE 




EFFECTIVE: 03/23/89 



23-8.1 Interdivisional Travel of FBI Personnel on Official 
Business 

Interdivisional travel of investigative and support 
personnel may be authorized by the SAC with the concurrence of the SAC 
of the office to be visited. Only the ASAC, in the absence of the 
SAC, may approve such travel. 

EFFECTIVE: 03/23/89 
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23-8.2 



Foreign Travel of FBI Personnel on Official Business 
(See MIOG, Part I, 281-6.2; Legal Attache Manual, 4-8.) 



fu „^ n „. ( } T Jf FBI 1S re P««nted abroad by Legal Attache 
ttTn °* £lCeS ' The """« ° f the Legat should be utilized by FBI 
Headquarters personnel and domestic field offices requiring 

SI'Lin""'" ": £ Si? ne# abr ° ad " the ***** is qualified to handle 
the full range of FBI matters overseas. Where a country not covered 
by a Legat is involved, Interpol or U.S. Department of State (USDS) 
channels can be used. However, where unique expertise in a complex 
matter is needed to facilitate interviews and/or investigations by 
4-°4^ 1 - g ^y.t h -?f_lLies;_.where_ _travel is_necess_ary for attendance at 

international symposiums of conferences with'police of f icTaUT or 

travel is^desired for some other official liaison or related purpose, 
consideration will be given to requests for participation of FBI 
Headquarters personnel and field Special Agents on a case-by-case 

illll'ntl" ^ 6Vent ' f ° reign travel should be coordinated with the 
Legat Office covering the country concerned and the | International 

t fiT ? e \ tl ? n ClRS),|Crininal Investigative Division. The Legat 
should be kept informed as to contemplated activity to ensure 
appropriate coordination with foreign agencies. The Legat will also 
be able to comment as to any other current activity or circumstance in 
the foreign country which may have some effect on the travel activity. 

.. f 2) Due t0 a wide variety of requirements imposed bv 
other countries on visits of foreign police officials and the fact 
that each visit is different and presents diversified problems, no 
attempt is being made to set forth country-by-country guideline.'*, to 
exact procedures that should be followed for such travel. However, 
the following minimal requirement* must be met before approval of any 
contemplated foreign travel will be considered by FBIHQ: 

All requests for foreign travel on official business must be in 
writing and include, where applicable, but not be limited to: 

and m-m. nf n U l c N T ° f em P lo y ee » traveling. (Include name 
and title of other U.S. Government persons accompanying.) 

.. „. ^ Synopsis of case. Include information on 
investigation or prosecution of any foreign nationals. State if case 
is in the investigative, indictment, or trial stage. 

, . (c) Purpose and nature of trip to include unique 

^"SIT"" ^ " necessarv that e^loyee must personally 
make the trip as opposed to matter being handled through appropriate 
liaison channels by Legat, Interpol or USDS. 
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V*^^-' 



•..iw;f / - (d) / a f e ° f co ^ ntrv to be visited, identifying 
authorities/agencies to be contacted and whether or not they have 
requested and/or agreed to the visit. 

'<«> Identity and nationality of persons and/or firms 
involved as suspects or Witnesses, if known. Specifically identify 
foreign nationals being interviewed or deposed. 

, ... ( f ) Proposed itinerary (Include mode of travel, 
accommodation arrangements or requirements, etc.). 



other expenses. 



(g) Estimated" cost of transportation, per diem"7~ind~ 



- . v . (h) Re <l u est for authority to travel for the purpose 
of interviews or undercover operations outside the United States must 
be supported by full Justification and must include the personal 
recommendation of the SAC. 

(i) Provide the identity of any foreign embassy 
consular or diplomatic officials who have been consulted regarding 
travel. Specify if assistance of American embassy/consulate or other 
personnel is required (e.g., consular officer to administer oath) or 
if office space at post is required. Also state if assistance of a 
stenographer, court reporter or interpreter is required. 

(j) Other factors 

All of the above questions must be answered as fully as possible if 
foreign travel is for the purpose of obtaining evidence suitable for 
U.S. Court presentations, e.g., interview under oath or obtaining 
physical evidence such as bank documents. In all foreign countries, 
certain certifications to the U.S. Government are necessary regarding 
evidence and a responsible U.S. Embassy Consular Officer must further 
certify the material for U.S. Courts. Arranging for U.S. Court 
certifications requires at least two weeks' notice and travel relating 
to same must be scheduled with the appropriate Embassy, usually by the 
prosecuting U.S. Attorney. y y 

In addition to answering the above questions, advise FBIHQ if foreign 
travel is being performed while carrying official or classified 
documents or equipment since a NonPROCOURIER letter is required for 
same. The[lRS|will aid in arranging for the courier letter and for 
the diplomatic pouching and sealing of the material being transported. 
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in «,.,...* k 3) /^tt^ Ag6ntS may not carrv Rearms or participate/ 
rUeTIbrn^ ' credent i al * ^V be carried while on official 
count™ Y ' howeVer ; use and /<" display of credentials in a foreign 
country is inappropriate. *"*6» 

. . „ L ^ FBI Agents have no jurisdiction in foreign 
countries. The reason for this is that no U.S. laws can override a 

Howe'vS 'J!? ? Y 1 !" '• Pr0t ? Ct tHe inte « rit y ^ ^s sovereignty, 
several VeLraf^^r l " V " U « at ^ e responsibilities overseas under 
several Federal statutes which provide for extraterritorial 
application. Though not limited to terrorist activity, generally such 
_i^^.ga_tLqns_have__bj ?en conducted in terrorist's attars. In cases 
EtUt s 6 FBI a" J 66 " .•- tto ; i «f-"^^Siin7 "abroad 15^?- 
have been J g ^conduct those investigative activities which 
nave been coordinated and approved by FBIHQ. FBIHQ will conduct 

SunTYY CO Yi n Y on with the Department of State to obtain host 
country approval to allow the FBI Agents to conduct the necessary 
investigative activity abroad. (See MIOG, Part II, 11-2.3.3(2), 
li-*.L\ Legal Handbook for Special Agents, 3-11.) 

c . , t (b) L «gats» border office Agents, and other FBI 
Special Agents or employees, even though invited or requested bv 
foreign authorities to participate in and/or observe arrests and 
searches of subjects or transportation of prisoners, may not do so. 

(A) Official passports and visas are required for all FBI 

?k"Z B aV6hng abr ° ad ° n offici al business and are issued only by 
the USDS Passport Office in Washington, D.C., upon receipt of a 
request signed by the Director, FBI. A tourist passport is not 
appropriate for official travel bat is permitted if safety of the 
traveler is a concern. (See Legal Attache Manual, 4-8.) 

- . , „ , t . (a) V ,S ' Pass P° r t law is contained in the Code of 
Federal Regulations, Title 22, Chapter 1, Part 51. The I IRS, 
CKI, (maintains contact with the USDS Passport Office for the purpose 
of obtaining official passports for FBI personnel. Proof of U S 
citizenship, two 2 x 2-inch photos, an acceptable certified birth 
certificate, or certificate of naturalization and a signed passport 
application are necessary to obtain a passport. When applying for the 
initial passport, the applicant must appear in person before a 
passport official empowered to certify the applicant's identity. The 
applicant must sign the passport application in this official's 
presence. Subsequent passports can be obtained by providing a 

IIZIIZ Pa ™ P ° rt Wit Y he a PP lic *tion and personal appearance is not 
required. The prospective traveler should contact | IRS, CID.Ifor an 
official passport after receiving authority to travel. The subject 
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nulh«r a nH h r eaU /^ mUniCatl ° n ™ th °rizing travel, the Bureau file 
number and dates of travel should be provided. A passport application 

/! ° b J"»?f locall y. cotnpleted, appropriately certified and 
forwarded with all necessary information to thellRS, CID,|as 
expeditiously as circumstances warrant. The official passport will be 
obtained along with any visas needed and the passport will be returned 
vLr« 6 7r? U ? St1 ^ 0f£ i cia1 ' 0fficial Passports will be valid for five 
two M ; B J fi; Z ?H 10 " normal l iaison <*annels requires approximately 
two weeks for the issuance and return of an official passport, plus 
three days for each visa. 

^— 0£ - f icial^passpprts.. issued to FBI personnel in 



the field should be returned to the SAC for retention at the 
conclusion of the official foreign travel. The passport should be 
| returned to| IRS, CID,|FBIHQ, on expiration, separation from official 
status with the FBI, or when no longer needed. It will then be 
returned to the USDS Passport Office. An official passport is not to 
be used for personal or pleasure travel, and any loss should be 
reported at once. 

„.,.. , , (c) t A visa is a Permit, entered on the passport of a 
national of one country, by the consular of another. This permit 
allows the bearer entry to, or transit through, the country issuing 

fh! ?! rm ^' , *! t t me f ° r Which Vis " a " issued usuallv de P«** °n 
the length of the trip. Applications, pictures, International Health 

Cards, and other certified documents may be required before visas are 

issued. Official travel to most countries requires a visa. The visa 

f ro ™ Sir in I "'I- u pass P° rt used for travel. Visas are obtained 
from that country's Embassy or Consulate in the U.S. Foreign 
diplomatic establishments require a USDS, Washington, D.C., Passport 
Office letter before they will issue a visa for official travel. 

On request, the|lRS, CID, |will also obtain visas 

IZttTr? V ?" XCial *" v » l - In addition to time needed to obtain a 
passport, should a visa(s) be necessary, an additional three days will 
be needed to obtain each one. 

(5) U.S. government travel regulations dictate that a 
government employee traveling on official business must use a U S 
carrier, whenever available. GSA travel regulations also require'use 
of contract air carriers, if available. GSA has awarded international 
city-pair contracts for foreign travel by federal civilian employees. 
The use of the contract carriers between the designated city-pairs is 
mandatory. | (See MAOP, Part II, 6-1.1.2, re city-pairs.) | 

Before leaving the U.S., foreign travelers, even on 
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official business, may wish to check on U.S. Customs regulations. 
Customs regulations require filing a declaration of personal property 
m excess of certain monetary amounts. Reentry processing is eased if 
a Customs declaration is submitted before leaving the U.S. 

(6) Since official passports and visas provide no 
immunity for the bearer, he/she (the bearer) can be held fully liable 
for all actions while abroad. This liability is both civil and 
criminal under the laws of the host country, which are often different 
to those in the United States. 

___ (7) 



_M-L_oOhe_foregoing instruction^ donot^jtecessarily 
apply to investigations in Canada and Mexico. However, with""e"x"cTp~tion" 
of established liaison visits by border offices, no Special Agent or 
person under FBI operational direction and control is to travel to 
Canada or Mexico without prior coordination with Legat, Ottawa or 
Legat, Mexico City, through FB1HQ. Furthermore, if a border office 
contemplates, the utilization of the undercover technique, wherein a 
Special Agent or person under FBI operational direction or control may 
be required to enter into Canada or Mexico, authority from FBIHQ must 
first be obtained. Requests for such authority must be in writing, 
must be supported by full justification, and must include the personal 
recommendation of the SAC. In an emergency, FBIHQ authority may be 
requested telephonically, but such a request must be followed by 
teletype that sets forth the required information without delay. 

(8) In compliance with Title 22, USC, Section 3927, and 
an agreement between the Attorney General and Secretary of State, 
Legal Attaches must keep Chiefs of Mission (usually the U.S. 
Ambassador in a country) fully and currently informed about all FBI 
programs and activities carried out in their countries of 
accreditation. If a Chief of Mission believes an FBI activity might 
impair relations with the country to which Chief is accredited, the 
Chief is authorized to suspend such activity pending further 
resolution. Therefore, when activity abroad by personnel of FBIHQ or 
domestic offices is proposed, full facts must be furnished because, as 
a law enforcement agency, FBI activity overseas may have unforeseen 
ramifications. It will be necessary to inform and obtain the 
concurrence of the host country government at an appropriate policy 
level regarding the proposed FBI activity. In cases where it is 
proposed to visit a country not covered by a Legat, arrangements 
should be made through the USDS. In either case, the FBIHQ 
substantive desk supervisor, with the assistance of|lRS, CID, I 
personnel, will initiate needed action. Action by FBIHQ substantive 
desk supervisors entails obtaining FBIHQ approval for foreign travel; 
preparing a written no-foreign-policy-objection notification to USDS 
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ensuring that an FBI lllJ III I investigative jurisdiction; and 

concurring „f?i, Legal Attache or USDSHQ has obtained the 

bH- :«:?. ih • : fo a r T°L ri : uc e h u i- chief of Mission in th « «*-*,*■* 

given In\h» !I! V " ° uch adv »nce notice as possible should be 
liaison cental « 0Ut . in * meetin 6 s with established foreign 

no? fiL"on of the Z5**™? *"* ° ther ^ a * encies ^roaS, 
rehired ?h«n^%-P- C ° U ^ tr ^ « overnme »t will not normally be 
the U S Chiel "J 1 ;? 1 ^ 1 ^ *«cI.ion, however, is the prerogative of 
2?-lJ.1c2 ( )f 7 ) MlSS1 ° n abr0ad ' (See MI0G ' Part I- «3-6? Part II, 



G 




% i£E «ti«; l'™';" Eft*- »«■'■«*« -t^viev „ . 

■ be oarticinaf^rf ,•« k« I ' , dl P loffiat,call y protected premises may 
I Repr...ntini Foreign Governments." (See KIOG, Part if 163-6.) 

.b. withheld or livS e"»d"t™„:;? y !» e G °""™" t - Su °» *"-»'<■» My 

«* t-u ■ .... ^ "Reasonable notice should be Riven of anv »,'=,> 

whi h a"' n'tendett T^S' '^ md the fuCu " ° f '"• nqC'rl " 
which are intended to be conducted in the United Kingdom." 

representing the clrZe^ai^^ . , 

present at any interview. Interv£e ws may o^ly b e ° TnlTt^U^L 

COf 
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consent of the person to be interviewed, or' with the suDDort of 

StVnl l? th 7 itV *""? the UniUd kingdom which^ay p^t 
examination of a person in response to an order of a 6ourt?" 

advise the ^./S^'^ -t 

United Kingdom in the form requested by the Government or agency." 

FBI Agents conducting 
abide by these guidel 
request or .. demand. is. 
the contents or resul 
their consent in Grea 
which no information 
Kingdom, or to disclo 
other than the result 



investigations in the United Kingdom should 
ines. Notify the Deputy Director promptly if a 
.issued by United Kingdom. authorities to disclose 
ts of interviews of United States persons with 
t Bntain by FBI Agents in those instances in 
is developed about an offense within the United 
se any details of an investigation by the FBI, 
s of an interview of non-United States persons. 




EFFECTIVE: 02/14/97 
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23-9 CLASSIFIED INFORMATION PROCEDURES ACT (CIPA) I (SEE MIOG, 
PART I, 259-2.) | r 

The CIPA of 1980 (Public Law 96-456, 94 Stat. 2025), Title 
18, United States Code, app. Ill, established certain pretrial, trial 
and appellate procedures for criminal cases in which there is a 
possibility that classified information will be disclosed. The Act 
required that the Chief Justice of the United States issue 
instructions establishing procedures for the protection against 
unauthorized disclosure of any classified information in the custody 
of the United States Distri ct Courts, Courts of Appeal, or Supreme 
Court. " — 



EFFECTIVE: 04/12/94 



23-9.1 Notification to United States Attorney 

(1) Prior to any factual discussion of such a case, 
ensure that the United States Attorney (USA) possesses the clearances 
necessary for access to classified material, noting that USAs do not 
necessarily have security clearances. To verify a USA's clearance, 
contact the Security Programs Manager (SPM) , FBIHQ. USAs requiring a 
clearance should refer to the United States Attorney's Manual for 
guidance. 

(2) Upon the initial presentation for a prosecutive 
opinion to the USA, the USA should be advised that the case will or 
may involve the disclosure of classified information. 

(3) The USA should also be advised that should it become 
necessary to clear persons for access to classified information, the 
clearance granting procedure will consume approximately 90 days. If 
exigencies of the situation dictate priority handling of the 
processing, the clearance may be granted more expeditiously, but as 
much advance notice as possible should be provided. 

EFFECTIVE: 03/23/89 
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23-9.2 



Notification to FBIHQ 



Upon making the determination that the litigation of a 
case will or may involve the disclosure of classified information, 
promptly notify the FBIHQ component responsible for supervision of the 
rS^ ? i V6 , V !; 0l ^ 10n Snd Moffice of the General Counsel 
(OGC) J Include in the notification a brief synopsis of the case, the 
identity of the USA to whom the case was presented and the date it was 
presented. 



EFFECTIVE: 09/09/94 



23-9.3 



Court Security Officer 



O 



ru- * t .- Procedures issued in accordance with the Act by the 
Chief Justice of the United States require the appointment of a Court 
Security Officer m any proceedings in which classified information is 
involved, or is reasonably expected to be involved. 

(1) The field office Security Officer or Alternate 
Security Officer will be the FBI nominee to serve as Court Security 
Officer. The designation of the Court Security Officer is left to the 
discretion of the judge presiding at the trial. 

r - c , (2) If a Special Agent (SA) is appointed to serve as 
Court Security Officer, insofar as the SA's duties pertaining to the 
trial are concerned, the SA is considered an officer of the Court and 
is, therefore, guided by the Court. 

.. _ (3) 0nce an SA *• selected, he/she is to promptly contact 
the Department of Justice (DOJ) Security Officer and the FBI SPM for 
guidance as to the responsibilities attendant to the appointment. 

nec - , .. (4) I£ any conflict develops between the Court Security 

Officer duties and FBI regulations governing an SA's other 
responsibilities, the SAC, |OGC|and the SPM at FBIHQ are to be 
immediately notified. 




EFFECTIVE: 09/09/94 
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23-9. A 



Duties of Court Security Officer 



The Court Security Officer is responsible to the Court for 
document, physical, personnel and communications security and is to 
take measures reasonably necessary to fulfill these responsibilities 
as set forth in the "Security Procedures Established Pursuant to 
Public Law 96-456, 94 Stat. 2025, by the Chief Justice of the United 
States for the Protection of Classified Information." 



EFFECTIVE: 12/10/91 



c 



23-9.5 



Procedures for Obtaining Security Clearances 



Excluding the presiding judge and jury no person appointed 
by the Court or designated for service at the trial shall be given 
access to any classified information in the custody of the Court 
unless such person has been granted a security clearance up to the 
level of the material to which they will have access. 

(1) The Court Security Officer shall obtain from the 
Court the identities of the person (s) requiring security clearances 
and promptly notify the DOJ Security Officer, who will initiate the 
clearance granting procedures. Upon confirmation of the clearances, 
the DOJ Security Officer will notify the Court in writing as to the, 
identities of the cleared personnel. 

(2) The DOJ Security Officer will advise the Security 
Programs Office, FBIHQ, of the identity(s) of the person(s) requiring 
a background investigation, which shall be conducted in accordance 

,with|Part I, Section 259; and[Part II, Section 17, of this manual; 
and/or the FCI Manual, Part II, 1-10; or MIOG, Part II, 26-10, as 
applicable. 

(3) The FBI will conduct the background investigations in 
all CIPA cases and report the investigative results to the DOJ 
Security Officer. 



*i0 
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geographic area assigned to each field office, including Legal _:;__. . A , 
Attaches. Each office's specific territory is listed for the purpose ' :. 
of setting out investigative leads and for liaison coverage. 
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EFFECTIVE: 01/31/78 
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THE STATES 




EFFECTIVE: 01/31/78 



Cll 
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COUNTY 

Autauga 

Baldwin 

Barbour 

Bibb 

Blount 

Bullock 

Butler , 

Calhoun > 

Chambers 

Cherokee* 

Chi i ton 

Choctaw ,. 

Clarke 

Clay 

Cleburne 

Coffee 

Colbert 






ALABAMA 



Resident agency(s) listed has direct mail service. 

COVERED BY 
OFFICE (RA) 
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Mobile (Montgomery) 
Mobile; . 

Mobile^rV-v / 
Birmingham.. „ / 
Birmingham v 
Mobile (Montgomery) 
Mobile (Montgomery) 
Birmingham ■-- •'.4' J * ; „ 
Mob'ile.- ,•>]£'■'■• ; j '•'■' .' 
Birmingham .; '■"■ ■ ";; ;:> '"• ■ ■•';• 
Mobile (Montgomery)-, 
Mobi te_>;'^. ; ■^'^ ■ ';./ ''* '■ 
Mobile '.-' '~''~l'/'>". ,'. 
Birmingham ;■ '" ': 
Birmingham, 
Mobile. ',,, " 
Birmingham '.'. 
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' Conecuh 
Coosa 
Covington 
Crenshaw 
Cullman 
Dale 

| Dallas 
De Kalb 
Elmore 
Escambia 
Etowah 
__Eayette__ 



m. 




Franklin 

Geneva 

Greene 
| Hale 

Henry 

Houston 

Jackson 

Jefferson 

Lamar 

Lauderdale 

Lawrence 

Lee 

Limestone 

Lowndes 

Macon 

Madison 

Marengo 

Marion 

Marshall 

Mobile 

Monroe 

Montgomery 

Morgan 
| Perry 

Pickens 

Pike 

Randolph '? 

Russell 

St. Clair 

Shelby 

Sumter 

Talladega 

Tallapoosa 

Tuscaloosa 



Mobile " 

Mobile (Montgomery) 

Mobile 

Mobile (Montgomery) 

Birmingham •? 

Mobile 

Mobile | (Montgomery) | 

Birmingham 

Mobile (Montgomery) " 

Mobile 

Birmingham 

.Birmingham 

Birmingham 

Mobile 

Birmingham. 

Mobile | (Montgomery) | 

Mobile 

Mobile 

Birmingham 

Birmingham 

Birmingham 

Birmingham 

Birmingham 

Mobile 

Birmingham 

Mobile (Montgomery) 

Mobile 

Birmingham 

Mobile 

Birmingham 

Birmingham 

Mobile . 

Mobile 

Mobile (Montgomery) 

Birmingham 

Mobile | (Montgomery) 

Birmingham 

Mobile (Montgomery) 

Mobile \/: 

Mobile, -«-■-*■ 

Birmingham 

Birmingham 

Birmingham 

Birmingham 

Mobile 

Birmingham 
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Walker 7 - : 
Washington 
Wilcox 
Winston 



Birmingham 
Mobile . . 
Mobile *'*"'.• 
Birmingham 
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EFFECTIVE: .07/03/97 



24-2.2 ALASKA 



'j£.S"3bSS? 
.... '*:^#M 

7 "' ''^^fsij' 



. -MM- 



All counties covered by the office at Anchorage. 






EFFECTIVE: 09/08/78 



*A£3"k 24-2.3 ARIZONA 




All counties covered by the office at Phoenix | except that 
part of the Navajo Indian Reservation lying within Apache County is . 
covered by Albuquerque. | 



■f.-m 



EFFECTIVE: 09/08/78 



24-2.4 



ARKANSAS 




All counties are covered by the office at Little Rock. 
Resident agency(s) listed has direct mail service. 





COVERED BY 




COUNTY 


OFFICE (RA) 




Arkansas 


' Little Rock 


? 


Ashley . 


Little Rock 


(Fort Smith) 


Baxter 


Little Rock 


(Fort Smith) 


Benton 


Little Rock 


(Fort Smith) 


Boone 


Little Rock 


(Fort Smith) 


Bradley 


Little Rock 


(Fort Smith) 


Calhoun 


Little Rock 


(Fort Smith) 
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Carroll ' . ■ ' 


Little Rock 


(Fort 


Smith) 


Chicot 


Little Rock] 






Clark 


Little Rock 


(Fort 


Smith) 


Clay 


Little Rbck| 






Cleburne 


Little Rock 






Cleveland 


Little Rock| 






Columbia 


Little Rock 


(Fort 


Smith) 


Conway 


Little Rock 






Craighead 


Little Rockj 






Crawford 


Little Rock 


(Fort 


Smith) 


Crittenden 


Little Rock 






Cross 


Little Rock 
Little Rock 






Dallas 






Desha 


Little Rock 






Drew 


Little Rock 






Faulkner 


Little Rock| 






Franklin 


Little Rock 


(Fort 


Smith) 


Fulton 


Little. Rock 






Garland 


Little Rock 


(Fort 


Smith) 


Grant 


Little Rock 






Greene 


Little Rock| 






Hempstead 


Little Rock 


(Fort 


Smith) 


Hot Springs 


Little Rock 


(Fort 


Smith) 


Howard 


Little Rock 


(Fort 


Smith) 


Independence 


Little Rock| 






Izard 


Little Rock 






Jackson 


Little Rock 






Jefferson 


Little Rock 






Johnson 


Little Rock 


(Fort 


Smith) 


Lafayette 


Little Rock 


(Fort 


Smith) 


Lawrence 


Little Rock 






Lee 


Little Rock 






Lincoln 


Little Rock 






Little River 


Little Rock 


(Fort 


Smith) 


Logan 


Little Rock 


(Fort 


Smith) 


Lonoke 


Little Rock 






Madison 


Little Rock 


(Fort 


Smi th) 


Marion 


Little Rock 


(Fort 


Smith) 


Miller 


Little Rock 


(Fort 


Smith) 


Mississippi 


Little Rock 






Monroe 


Little Rock 






Montgomery 


Little Rock 


(Fort 


Smith) 


Nevada 


Little Rock 


(Fort 


Smith) 


Newton 


Little Rock 


(Fort 


Smith) 


Ouachita 


Little Rock 


(Fort 


Smith) 


Perry 


Little Rock 










■At: 



r'-'L-tiv"' 

•■133 



.2 



'S- 



■j& 



■ ■•*%■ 
■■# 

■"V-ii. 

% 
/• . 
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-jftc 



• 


Phillips •'•-" 


"•' Little Rock| 


...'■■ ■ "ix- 


■ L Pike . 


Little Rock (Fort Smith) 


' . ' **•*'•< 


| (Poinsett 


Little Rock] 


■v- ''& 


Polk 


Little Rock (Fort Smith) 


y : : 4£ 




[Pope 


Little Rock 


'■'%: 




Prairie 


Little Rock 


i,' . 




Pulaski 


Little Rock 


;;fe 




Randolph 


Little Rock 






Saline 


Little Rock| 


v-'"„-< - 


Scott 


Little Rock (Fort Smith) 


' #■ 


Searcy 


Little Rock (Fort Smith) 


'?J&r' 


Sebastian 


Little Rock (Fort Smith) 




Sevier 


Little Rock (Fort Smith) 


' y-H-. '■ 


1 [ Sharp 


Little Rock 




1 St. Francis 


Little Rock| 


• -^ 


Stone 


Little Rock 


' ■£,- 


Union 


Little Rock (Fort Smith) 


,~ .-"-te 


Van Buren 


Little Rock 


r* 


Washington 


Little Rock (Fort. Smith) 




/V& 


[White 


Little Rock 




C : - $ 


Woodruff 


Little Rock 


;# 


\*> 


Yell 


Little RockJ 


%A 






EFFECTIVE: 02/10/97 



24-2.5 CALIFORNIA 

(Resident agencies listed have direct mail service. 







COUNTY 

Alameda 
Alpine 
Amador 
Butte 
Calaveras 
Camp Roberts 
Colusa 

Contra Costa 
Del Norte 
Edwards Air 
Force Base 



COVERED BY 
OFFICEj (RA) | 

San Francisco | (Oakland) 

Sacramento 

Sacramento 

Sacramento 

Sacramento 

Los Angeles 

Sacramento 

San Francisco 

San Francisco 

Los Angeles 
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El Dorado 

Fresno 

Glenn 

Humboldt 

Imperial 

Inyo 

Kern 
(Except Edwards Air 
Force Base which is 
covered by Los Angeles) 



Sacramento 
Sacramento | (Fresno) 
Sacramento 
San Francisco 
San Diego 

Sacramento (Fresno) 
Sacramento (Fresno) 



| Kings 
Lake 



Sacramento] (Fresno) 
San Francisco 




Lassen 

Los Angeles 
| Madera 

Marin 
| Mariposa 

Mendocino 
| Merced 

Modoc 

Mono 
[ Monterey 

(Except Camp Roberts 
which is covered by 
Los Angeles) 

Napa 

Nevada 
| Orange 

Placer 

Plumas 
| Riverside 

Sacramento 

San Benito 

San Bernandino 

San Diego 

San Francisco 

San Joaquin 

San Luis Obispo 

San Mateo 

Santa Barbara 

Santa Clara 

Santa Cruz 

Shasta 

Sierra 

Siskiyou 

Solano 



Sacramento 

Los Angeles 

Sacramentof (Fresno) | 

San Francisco 

Sacramento | (Fresno) | 

San Francisco 

Sacramento | (Fresno) | 

Sacramento 

Sacramento 

San Francisco I (San Jose) 



San Francisco 

Sacramento 

Los Angeles | (Santa Ana) | 

Sacramento 

Sacramento 

Los Angeles j (Riverside) | 

Sacramento 

San Francisco) (San Jose) 

Los Angeles | (Riverside) | 

San Diego 

San Francisco 

Sacramento 

Los Angeles 

San Francisco 

Los Angeles 

San Francisco (San Jose) 

San Francisco (San Jose) 

Sacramento 

Sacramento 

Sacramento 

Sacramento 



•-,i .:■*..- 

•■••3* 

■. WiS, ■ 
''.Sft 

■*& 

•-'-■%;; 






■ . ■< 
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Sonoma 

Stanislaus 

Sutter 

Tehama 

Trinity 

Tulare 

Tuolumne 

Ventura 

Yolo 

Yosemite 

National Park 
Yuba 



San Francisco ' 

Sacramento 

Sacramento 

Sacramento 

Sacramento 

Sacramento | (Fresno) 

Sacramento 

Los Angeles 

Sacramento 

Sacramento 

Sacramento 











1 , 








->■,$%% 

.*#'. 




>V£ 




- ■ -:*m 




■ 3\V:m 




■ ■ .-r%tr 












...'f&i 


24 - 7. 


.'4SuJ' 


-*■ 


" *$t 


.>*-■ 


.•.-'•*S' 




' i-'^-V 


-■ . ■ • 


■ ■ -.'*R.<v3' 




M 




?2f 



*;■ 



'■S3& 



tf 



"3^ 



I 



EFFECTIVE: 11/03/95 



24-2.6 COLORADO 



All counties covered by the office at Denver. 






-■ft 

' ~'S ■ 



EFFECTIVE: 01/31/78 



24-2.7 CONNECTICUT 



All counties covered by the office at New Haven. 






EFFECTIVE: 01/31/78- 



^ 



24-2.8 DELAWARE 



All counties covered by the office at Baltimore. 



EFFECTIVE: 01/31/78 
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:|4 

.- ^* 



,=>f 



Covered by the Field Office at Washington 



A 



EFFECTIVE: 01/31/78 



24-2.10 FLORIDA 
J [ Resident a ge ncies li ste d have direct mail service. 



w 








COUNTY 

Alachua 

Baker 

Bay 

Bradford 

Brevard 

Broward 

Calhoun 

Charlotte 

Citrus 

Clay 

Collier 

Columbia 

Dade 

De Soto 

Dixie 

Duval 

Escambia' 

Flagler 

Franklin 

Gadsden 

Gilchrist 

Glades . 

Gulf 

Hamilton 

Hardee 

Hendry 

Hernando 

*High lands 
Hillsborough 
Holmes 



COVERED BY 
OFFICE | (RA) | 



Jacksonvi 

Jacksonvi 

Jacksonvi 

Jacksonvi 

Tampa 

Miami 

Jacksonvi 

Tampa 

Jacksonvi 

Jacksonvi 

Tampa 

Jacksonvi 

Miami 

Tampa 

Jacksonvi 

Jacksonvi 

Jacksonvi 

Jacksonvi 

Jacksonvi 

Jacksonvi 

Jacksonvi 

Tampa 

Jacksonvi 

Jacksonvi 

Tampa 

Tampa 

Tampa 

Miami 

Tampa 

Jacksonvi 



He 

lie 

He | (Pensacola) 

He 



lie | (Pensacola) 

He 
He 

He 



He 

lie 

He | (Pensacola) 

He 

He 

He 

lie 



(Tallahassee) 
(Tallahassee) 



lie | (Pensacola) j 
lie 



lie | (Pensacola) 
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Indian River 

Jackson 

Jefferson 

Lafayette 

Lake 

Lee 

Leon 

Levy 

Liberty 

Madison 

Manatee 

Marion 



Martin 

Monroe 

Nassau 

Okaloosa 

Okeechobee 

Orange 

Osceola 

Palm Beach 

Pasco 

Pinellas 

*Polk 
Putnam 
St. Johns 
St. Lucie 
Santa Rosa 
Sarasota 
Seminole 
Sumter 
Suwannee 
Taylor 
Union 
Volusia- 
Wakulla. 
Walton '*'- 
Washington 



Miami 

Jacksonville 

Jacksonville 

Jacksonville 

Jacksonville 

Tampa 

Jacksonville 

Jacksonville 

Jacksonville 

Jacksonville 

Tampa 

Jacksonville 



(Pensacola) | 

(Tallahassee) 

(Tallahassee) 



(Tallahassee) 

(Tallahassee) 
(Tallahassee) 



Miami 

Miami 

Jacksonville 

Jacksonville! 

Miami 

Tampa 

Tampa 

Miami 

Tampa 

Tampa 

Tampa 

Jacksonville 

Jacksonville 

Miami 

Jacksonville 

Tampa 

Tampa 

Jacksonville 

Jacksonville 

Jacksonville 

Jacksonville 

Jacksonville 

Jacksonville 

Jacksonville 

Jacksonville 



(Pensacola) 



(Pensacola) 



(Tallahassee) 



(Tallahassee) 

(Pensacola) 

(Pensacola) 



9 



*Note: Leads for the Florida State Correctional Institution, also 
known as the Avon Park Correctional Institution, which has a mailing 
address of Avon Park, Florida, and the Avon Park Bombing and Gunnery 
Range are covered by the Tampa Division. 
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EFFECTIVE: 11/03/95 



24-2.11 GEORGIA 





"* 'i. , -" ; Y*y 


•%-. 


• i -\:. 


-■' 






.-;>,-■ 


■ • 






''7$8i 




■^,'P? 










- 10 






•^sV/- 




■?' 




• ■-■"^■ifc* 


- 






■ ,**f'f» 







All counties covered by office at Atlanta. 
agencies listed have direct mail service. 



Resident 



COUNTY 



COVERED BY 
_QFFICE_(RA)_ 




Appl ing 

Atkinson 

Bacon 

Baker 

Baldwin 

Banks 

Barrow 

Bartow 

Ben Hill 

Berrien 

Bibb 

Bleckley 

Brantley 

Brooks 

Bryan 

Bulloch 

Burke 

Butts 

Calhoun 

Camden 

Candler 

Catoosa 

Charlton 

Chatham 

Chattahooche 

Cherokee 

Clarke 

Clay 

Clinch 

Coffee 

Colquitt 

Columbus 

Cook 



Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 

Atlanta 



(Augusta) 

(Savannah) 

(Savannah) 

(Macon) 

(Macon) 

(Rossville) 

(Rossville) 

(Rossville) 

(Macon) 

(Macon) 

(Macon) 

(Macon) 

(Savannah) 

(Macon) 

(Savannah) 

(Augusta) 

(Augusta) 

(Macon) 

(Macon) 

(Savannah) 

(Augusta) 

(Rossville) 

(Savannah) 

(Savannah) 

(Macon) 

(Rossville) 

(Macon) 

(Macon) 

(Macon) 

(Augusta) 

(Macon) 

(Augusta) 

(Macon) 



m 



f', ifftf 



r 0. 



- • ,:7i 



'■-'#JS- 
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Crawford 


Atlanta (Macon) 




Crisp - 


• Atlanta (Macon) 




Dade 


Atlanta (Rossville) 




Daws on 


Atlanta (Rossville) 




Decatur 


Atlanta (Macon) 




Dodge . 


Atlanta (Augusta) 




Dooly 


Atlanta (Macon) 




Dougherty 


Atlanta (Macon) 




Early 


Atlanta (Macon) 




Echols 


Atlanta (Macon) 




Effingham 


Atlanta (Savannah) 




Elbert 


Atlanta (Macon) 




Emanuel 


Atlanta (Augusta) 




Evans 


Atlanta (Augusta) 




Fannin 


Atlanta (Rossville) 




Floyd 


Atlanta (Rossville) 




Forsyth 


Atlanta (Rossville) 




Franklin 


Atlanta (Macon) 




Gilmer 


Atlanta (Rossville) 


d 


Glascock 


Atlanta (Augusta) 


Glynn 


Atlanta (Savannah) 


Vii^ 


Gordon 


Atlanta (Rossville) 




Grady 


Atlanta (Macon) 




Greene 


Atlanta (Macon) 




Habersham 


Atlanta (Rossville) 




Ball 


Atlanta (Rossville) 




Hancock 


Atlanta (Macon) 




Haralson 


Atlanta (Rossville) 




Harris 


Atlanta (Macon) 




Hart 


Atlanta (Macon) 




Houston 


Atlanta (Macon) 




Irwin 


Atlanta (Macon) 




Jackson - 


Atlanta (Rossville) 




Jasper 


Atlanta (Macon) 




Jeff Davis 


Atlanta (Augusta) 




Jefferson 


Atlanta (Augusta) 




Jenkins 


Atlanta (Augusta) 




Johnson 


Atlanta (Augusta) 




Jones 


Atlanta (Macon) 




Lamar 


Atlanta (Macon) 




Lanier 


Atlanta (Macon) 




Laurens 


Atlanta (Augusta) '■ 




Lee 


Atlanta (Macon) 




Liberty 


Atlanta (Savannah) 


/^S^ 


Lincoln 


Atlanta (Augusta) 


^SP 


Long 


Atlanta (Savannah) 






.-«: 



4^ 



■'"■•£■ 

"lis; 



.' •JST-. 
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:#• 






Sensitive 
PRINTED: 02/18/98 










Sensitive 









Manual of Investigative Operations and Guidelines 
Part II 



PAGE 24 - 12 




v&- 




Lowndes 

Lumpkin 

Macon 

Madison 

Marion 

McDuffie 

Mcintosh 

Miller 

Mitchell 

Monroe 

Montgomery 

Mor g an 



Murray 

Muscogee 

Oconee 

Oglethorpe 

Paulding 

Peach 

Pickens 

Pierce 

Polk 

Pulaski 

Putnam 

Qui tman 

Rabun 

Randolph 

Richmond 

Schley 

Screven 

Seminole 

Stephens 

Stewart 

Sumter 

Talbot 

Taliaferro 

Tallnall 

Taylor 

Telfair 

Terrell 

Thomas 

Tift 

Toombs 

Towns 

Truetlen 

Turner 

Twiggs 



Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 



(Macon) 

(Rossville) 

(Macon) 

(Macon) 

(Macon). 

(Augusta) 

(Savannah) 

(Macon) 

(Macon) 

(Macon) 

(Augusta) 

( Macon) 



Atlanta (Rossville) 
Atlanta (Macon) 
Atlanta (Macon) 
Atlanta (Macon) 
Atlanta (Rossville) 
Atlanta (Macon) 
Atlanta (Rossville) 
Atlanta (Savannah) 
Atlanta (Rossville) 
Atlanta (Macon) 
Atlanta (Macon) 
Atlanta (Macon) 
Atlanta (Rossville) 
Atlanta (Macon) 
Atlanta (Augusta) 
Atlanta (Macon) 
Atlanta (Augusta) 
Atlanta (Macon) 
Atlanta (Rossville) 
Atlanta (Macon) 
Atlanta (Macon) 
Atlanta (Macon) 
Atlanta (Augusta) 
Atlanta (Augusta) 
Atlanta (Macon) 
Atlanta (Augusta) 
Atlanta (Macon) 
Atlanta (Macon) 
Atlanta (Macon) 
Atlanta (Augusta) 
Atlanta (Rossville) 
Atlanta (Augusta) 
Atlanta (Macon) 
Atlanta (Macon) 



•*'£& 
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■'Mf 
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Union 

Upson. 

Walker . 

Walton 

Ware 

Warren 

Washington 

Wayne 

Webster 

White 

Whitfield 

Wilcox 



Wilkes 

Wilkinson 

Worth 



Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 
Atlanta 



Atlanta 
Atlanta 
Atlanta 



(Rossville) 

(Macon) . 

(Rossville) 

(Macon) 

(Savannah) 

(Augusta) 

(Macon) 

(Savannah) 

(Macon) 

(Rossville) 

(Rossville) 

( Maco n) 



(Augusta) 
(Macon) 
(Macon) I 



EFFECTIVE: 11/03/95 



24-2.12 HAWAII 



Covered by the office at Honolulu. 



EFFECTIVE: 08/27/90 



24-2.13 



IDAHO 



Up -a - A11 w'uaties covered by the office at Salt Lake City. 
||Resident agency(s) listed has direct mail service. 





COVERED BY 




COUNTY . 


. OFFICE (RA) 




Ada 


Salt Lake City 


(Boise) 


Adams 


Salt Lake City 


(Boise) 


Bannock 


Salt Lake City 


(Boise) 


Bear Lake 


Salt Lake City 


(Boise) 


Benewah 


Salt Lake City 


(Boise) 


Bingham 


Salt Lake City 


(Boise) 


Blaine 


Salt Lake City 


(Boise) 


Boise 


Salt Lake City 


(Boise) 









..i.-s'SSfe- 



•,iT*«js-;. 

,1 cu-T 



1 *$&*.'• 
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Bonner 


Salt Lake City (Boise) 


Bonneville 


Salt Lake City (Boise) 


Boundary 


Salt Lake City (Boise) 


Butte 


Salt Lake City (Boise) 


Camas 


Salt Lake City (Boise) 


Canyon 


Salt Lake City (Boise) 


Caribou 


Salt Lake City (Boise) 


Cassia 


Salt Lake City (Boise) 


Clark 


Salt Lake City (Boise) 


Clearwater 


Salt Lake City (Boise) 


Custer 


Salt Lake City (Boise) 


Elmore 


Salt Lake City (Bniso) 


Franklin 


Salt Lake City (Boise) 


Fremont 


Salt Lake City (Boise) 


Gem 


Salt Lake City (Boise) 


Gooding 


Salt Lake City (Boise) 


Idaho 


Salt Lake City (Boise) 


Jefferson 


Salt Lake City (Boise) 


Jerome 


Salt Lake City (Boise) 


Kootenai 


Salt Lake City (Boise) 


Latah 


Salt Lake City (Boise) 


Lemhi 


Salt Lake City (Boise) 


Lewis 


Salt Lake City (Boise) 


Lincoln 


Salt Lake City (Boise) 


Madison 


Salt Lake City (Boise) 


Minidoka 


Salt Lake City (Boise) 


Nez Perce 


Salt Lake City (Boise) 


Oneida 


Salt Lake City (Boise) 


Owyhee 


Salt Lake City (Boise) 


Payette 


Salt Lake City (Boise) 


Power 


Salt Lake City (Boise) 


Shoshone 


Salt Lake City (Boise). 


Summit 


Salt Lake City (Boise) 


Teton 


Salt Lake City (Boise) 


Twin Falls 


Salt Lake City (Boise) 


Valley 


Salt Lake City (Boise) 


Washington 


Salt Lake City (Boise) 1 
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24-2.14" 



COUNTY 

Adams 

Alexander 

Bond 

Boone 

Brown 




Bureau 

Calhoun 

Carroll 

Cass 

Champaign 

Christian 

Clark 

Clay 

Clinton 

Coles 

Cook 

Crawford 

Cumberland 

De Kalb 

De Witt 

Douglas 

Du Page 

Edgar 

Edwards 

Effingham 

Fayette 

Ford 

Franklin 

Fulton 

Gallatin 

Greene 

Grundy 

Hamilton 

Hancock 

Hardin 

Henderson 

Henry 

Iroquois 

Jackson 
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ILLINOIS '■- : -V 

Resident agencies listed have direct nail 

COVERED BY 
OFFICE (RA) 

Springfield 
Springfield 
Springfield 
Chicago (Rockford) 
Sprjjigfield_ 



service. 



Springfield 

Springfield . 

Chicago (Rockford) 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Chicago (North, South & West) 

Springfield 

Springfield 

Chicago (Rockford) 

Springfield 

Springfield 

Chicago (North & West) 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Chicago (South) 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 
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Jasper 

Jefferson 

Jersey 

Jo Daviess 

Johnson 

Kane >■ 

Kankakee 

Kendall 

Knox 

Lake 

La Salle 

Lawrence 




Lee 

Livingston 

Logan 

Macon 

Macoupin 

Madison 

Marion 

Marshall 

Mason 

Massac 

McDonough 

McHenry 

McLean 

Menard 

Mercer 

Monroe 

Montgomery 

Morgan 

Moultrie 

Ogle 

Peoria 

Perry 

Piatt 

Pike 

Pope 

Pulaski 

Putnam 

Randolph 

Richland 

Rock Island 

St. Clair 

Saline 

Sangamon 

Schuyler 



Springfield 
Springfield 
Springfield 
Chicago (Rockford) 
Springfield 
Chicago (West) 
Springfield 
Chicago (West) 
Springfield 
Chicago (North) 
Chicago (South) 
_Sp£ing£ieid_ 



Chicago (Rockford) 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Chicago (Rockford) 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Chicago (Rockford) 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 

Springfield 
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Scott 
Shelby 
Stark 

Stephenson 
Tazewell 
Union 
Vermilion 
Wabash 
Warren 
Washington 
Wayne 
-White. 



Whiteside 

Will 

Williamson 

Winnebago 

Woodford 
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Springfield 
Springfield 
Springfield 
Chicago (Rbckford) 
Springfield 
Springfield 
Springfield 
Springfield 
Springfield 
Springfield 
Springfield 
_Springfield_ 
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Chicago (Rockford) 
Chicago (South) 
[Springf ield| , 

Chicago (Rockford) 
Springfield 



'••y? 




EFFECTIVE: 03/14/97 



24-2.15 



INDIANA 



All counties covered by the office at Indianapolis. 
|Resident agency(s) listed has direct mail service. 



(Herri Uvi lie) 
(Merrillville) 
(Merrillville) 
(Merrillville) 
(Merrillville) 
(Merrillville) 
(Merrillville) 
(Merrillville) 
(Merrillville) 
(Merrillville) 
(Merrillville) 
(Merrillville) I 







COVERED BY 




COUNTY 


OFFICE (RA) 




Elkhart 


Indianapolis 




Fulton 


Indianapolis 




Jasper 


Indianapolis 




Kosciusko 


Indianapolis 




Lake 


Indianapolis 




LaPorte 


Indianapolis 




Marshall 


Indianapolis 




Newton 


Indianapolis 




Porter 


Indianapolis 




Pulaski 


Indianapolis 


J 


St. Joseph 


Indianapolis 




Starke 


Indianapolis 
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EFFECTIVE: 11/03/95 



24-2.16 IOWA 



All counties covered by the office at Omaha. 
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EFFECTIVE: 01/31/78 



« 




24-2.17 



KANSAS 



. 4 A11 counties covered by the office at Kansas City. 
I [Resident agency(s) listed has direct mail service. 



COUNTY 

Allen 

Barber 

Barton 

Butler 

Chase 

Chautauqua 

Comanche 

Cowley 

Edwards 

Elk 

Greenwood 

Harper 

Harvey 

Kingman 

Kiowa 

Marion 

McPherson 

Montgomery 

Neosho 

Pawnee 

Pratt 

Reno 

Rice 

Rush 

Sedgwick 



COVERED 
BY OFFICE 



(RA) 



Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 
Kansas City 



(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 

(Wichita) 



V 



-JUL 

■m 
■A- 



■ •Of.: 



■M. 






LP. 
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Stafford 
Sumner 
Wilson 
Woodson 



Kansas City (Wichita) 
Kansas City (Wichita) 
Kansas City (Wichita) 
Kansas City (Wichita) I 



.'•ft?- ; ' 









EFFECTIVE: 11/03/95 



Ws; 



24-2.18 



KENTUCKY 



"i^ 



All counties covered by the office at Louisville. 



»**- 



EFFECTIVE: 01/31/78 






& 



24-2.19 



LOUISIANA 



All counties covered by the office at New Orleans, 
|Resident agencies listed have direct mail" service. 



, )■ . 




COUNTY 

Acadia 

Allen 

Beauregard 

Bienville 

Bossier 

Caddo 

Calacasieu 

Caldwell 

Cameron 

Claiborne 

DeSoto 

East Carroll 

Evangeline 

Fabine 

Franklin 

Iberia 

Jackson 

Jefferson Davis 

Lafayette 



COVERED BY 
OFFICE (RA) 



New 
New 

New 
New 

New 

New 

New 

New 

New 

New 

New 

New 

New 

New 

New 

New 

New 

New 

New 



Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans " 

Orleans 



(Lafayette) 

(Lafayette) 

(Lafayette) 

(Shreveport) 

(Shreveport) 

(Shreveport) 

(Lafayette) 

(Shreveport) 

(Lafayette) 

(Shreveport) 

(Shreveport) 

(Shreveport) 

(Lafayette) 

(Shreveport) 

(Shreveport) ' 

(Lafayette) 

(Shreveport) - 

(Lafayette) 

(Lafayette) 
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Lincoln New 

Madi s on New 

Morehouse New 

Ouachita New 

Red River New 

Richland New 

St. Landry New 

St. Martin New 

St. Mary New 

Tenfas New 

Union New 

_Ve.rini.li on New^ 

Webster New 

West Carroll New 



Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

Orleans 

OrJL.eans_ 

Orleans 

Orleans 



(Shreveport) 

(Shreveport) 

(Shreveport) 

(Shreveport) 

(Shreveport) 

(Shreveport) 

(Lafayette) 

(Lafayette) 

(Lafayette) 

(Shreveport) 

(Shreveport) 

(Lafay_ett.e)__ 

(Shreveport) 

(Shreveport) I 
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- 20 
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EFFECTIVE: 11/03/95 




1 



24-2.20 



MAINE 



.3 



All counties covered by the office at Boston. 



EFFECTIVE: 07/26/89 



24-2.21 MARYLAND 






*%■ 



^ All counties covered by the office at Baltimore except in 
certain applicant-type cases. In cases involving other than Bureau 

hJ P i;_?2 k- t C T t , i ! 8 rt «. M ° nt , g0,n x er r and Prince Geor * es are handled 
by the Washington Field Office (WFO) . | In Bureau support applicant 

cases, |WFO|handles recruiting and investigative leads in Montgomery, 

Prince Georges, Charles and St. Mary's Counties. In Special Agent 

applicant cases, all recruiting and investigative leads in Maryland 

are handled by the Baltimore Office. 



■ w. 
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24-2.22 MASSACHUSETTS 



All counties covered by the office at Boston; 









■;h 




-. fry* 


- 


' ■ '-'figs' 

■■fss 


- ,21 


■.r-sfis 

- -'^7* 

■■ vfc*- 











EFFECTIVE: 07/26/89 



24^2.23 



MICHIGAN 



Al l_c.o.unt i.es„..c.oy.ered3y_the_o f f i_ce_at_.Det roi t ,._| Res i dent_ 



agency (s) listed has direct mail service. 



■'^g 1 : 





COVERED 


BY 


COUNTY 


OFFICE 


(RA) 


Allegan 


Detroit 


(Grand Rapids) 


Barry 


Detroit 


(Grand Rapids) 


Berrien 


Detroit 


(Grand Rapids) 


Branch 


Detroit 


(Grand Rapids) 


Calhoun 


Detroit 


(Grand Rapids) 


Cass 


Detroit 


(Grand Rapids) 


Ionai 


Detroit 


(Grand Rapids) 


Kalamazoo 


Detroit 


(Grand Rapids) 


Kent 


Detroit 


(Grand Rapids) 


Lake 


Detroit 


(Grand Rapids) 


Mason 


Detroit 


(Grand Rapids) 


Mecasta 


Detroit 


(Grand Rapids) 


Montcalm 


Detroit 


(Grand Rapids) 


Muskegon 


Detroit 


(Grand Rapids) 


Newaygo 


Detroit 


(Grand Rapids) 


Oceana 


Detroit 


(Grand Rapids) 


Osceola 


Detroit 


(Grand Rapids) 


Ottawa 


Detroit 


(Grand Rapids) 


St. Joseph 


Detroit 


(Grand Rapids) 


Van Buren 


Detroit 


(Grand Rapids) 



•■■''V 
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24-2.24 



MINNESOTA 



All counties covered by the office at Minneapolis. 

l- 

EFFECTIVE: 07/26/89 
24-2.25 MISSISSIPPI 



All counties covered by the office at Jacks 



on. 



EFFECTIVE: 07/26/89 



24-2.26 MISSOURI 

(Resident agencies listed have direct nail 

COVERED BY 
COUNTY OFFICEl (RA) I 



service. 



Adair 

Andrew 

Atchison 

Audrain 

Barry 

Barton 

Bates 

Benton 

Bollinger 

Boone 

Buchanan 

Butler 

Caldwell 

Callaway . 

Camden 

Cape Girardeau 

Carroll 

Carter 

Cass 

Cedar 

Chariton 



St. Louis 

Kansas City 

Kansas City 

St. Louis . 

Kansas City 

Kansas City 

Kansas City 

Kansas City| (Springfield) 

St. Louis 

Kansas City 

Kansas City 

St. Louis 

Kansas City 

Kansas City 

Kansas City 

St. Louis 

Kansas City 

St. Louis 

Kansas City 

Kansas City[ (Springfield) | 

St. Louis 
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Christian' 

Clark . 

Clay 

Clinton 

Cole 

Cooper 

Crawford 

Dade 

Dallas 

Daviess 

De Kalb 

Dent 



Douglas 

Dunklin 

Franklin 

Gasconade 

Gentry 

Greene 

Grundy 

Harrison 

Henry 

Hickory 

Holt 

Howard 
| Howell 

Iron 

Jackson 

Jasper 

Jefferson 

Johns on 

Knox 

Laclede 

Lafayette 

Lawrence 

Lewis 

Lincoln 

Linn 

Livingston 

Macon 

Madison 

Maries 

Marion 

McDonald 

Mercer 

Miller 

Mississippi 



Kansas City| (Springfield) 

St. Louis 

Kansas City 

Kansas City 

Kansas City 

Kansas City 

St. Louis 

Kansas City 

Kansas City| (Springfield) | 

Kansas City 

Kansas City 

St. Louis 



(Springfield) 
(Springfield) 



Kansas City| (Springfield) 

St. Louis 

St. Louis 

St. Louis 

Kansas City 

Kansas City| (Springfield) J 

Kansas City 

Kansas City 

Kansas City 

Kansas City 

Kansas City 

Kansas City 

Kansas City| (Springfield) | 

St. Louis 

Kansas City 

Kansas City 

St. Louis 

Kansas City 

St. Louis 

Kansas City| (Springfield) | 

Kansas City 

Kansas City 

St. Louis 

St. Louis 

St. Louis 

Kansas City 

St. Louis 

St. Louis 

St. Louis 

St. Louis 

Kansas City 

Kansas City 

Kansas City 

St. Louis 









. >,>r. 
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Koniteau 

Monroe 

Montgomery 

Morgan 

New Madrid 

Newton 

Nodaway 

Oregon 

Osage 

Ozark 

Pemiscot 

Perry 




Pettis 
Phelps 
Pike 
Platte 
' Polk 
Pulaski 
Putnam 
Ralls 
Randolph 
Ray 

Reynolds 
Ripley 
St. Charles 
St. Clair 
St. Francois 
Sainte Genevieve 
. St. Louis 
St. Louis City 
Saline 
Schuyler 
Scotland 
Scott 
Shannon 
Shelby 
Stoddard 
Stone 
Sullivan 
Taney 
Texas 
Vernon 
Warren 
Washington 
Wayne 
Webster 



Kansas City -"• ■ 

St. Louis 

St. Louis 

Kansas City 

St. Louis 

Kansas City 

Kansas City 

Kansas City| (Springfield) | 

Kansas City 

Kansas City| (Springfield) | 

St. Louis 

St. Louis 



Kansas City 

St. Louis 

St. Louis . 

Kansas City 

Kansas Cityl (Springfield) 

Kansas City| (Springfield) 

Kansas City 

St. Louis 

St. Louis 

Kansas City 

St. Louis 

St. Louis 

St. Louis 

Kansas City| (Springfield) 

St. Louis 

St. Louis 

St. Louis 

St. Louis 

Kansas City 

St. Louis 

St. Louis 

St. Louis 

St. Louis 

St. Louis 

St. Louis 

Kansas City) (Springfield) 

Kansas City 

(Springfield) 



(Springfield) 



Kansas City 

Kansas City 

Kansas City 

St. Louis 

St. Louis 

St. Louis, 

Kansas Cityj (Springfield) 
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Worth 
Wright 



EFFECTIVE: 11/03/95 



Kansas City 

Kansas Cityj (Springfield) 






ai^SSL 









24-2.27 



MONTANA 



|R«,-H««h All counties covered by the office at Salt Lake City, 

|Resident_agency(s)_listed-has- direct...mail_service.-~_ JlL__ 



COUNTY 



COVERED BY 
OFFICE (RA) 










51 




Beaverhead 

Big Horn 

Blaine 

Broadwater 

Carbon 

Carter 

Cascade 

Chouteau 

Custer 

Daniels 

Dawson 

Deer Lodge 

Fallon 

Fergus 

Flathead 

Gallatin 

Garfield 

Glacier 

Golden Valley 

Granite 

Hill 

Jefferson 

Judith Basin 

Lake 

Lewis And Clark 

Liberty 

Lincoln 

Madison 

McCone 

Meagher 



Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 
Salt Lake City 



(Billings) 

(BiUings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings)' 

(Billings) 

(Billings) 

(Billings) 

(Billings) 

(Billings), 
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(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
jBil_lings)_ 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) 
(Billings) I 
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Mineral 


Salt Lake City 




Missoula 


Salt Lake City 




Musselshell 


Salt Lake City 




Park 


Salt Lake City 




Petroleum 


Salt Lake City 




Phillips 


Salt Lake City 




Pondera 


Salt Lake City 




Powder River 


Salt Lake City 




Powell 


Salt Lake City 




Prairie 


Salt Lake City 




Ravalli 


Salt Lake City 




Richland 


Salt Lake Citv 




Roosevelt 


Salt Lake City 




Rosebud 


Salt Lake City 




Sanders 


Salt Lake City 




Sheridan 


Salt Lake City 




Silver Bow 


Salt Lake City 




Stillwater 


Salt Lake City 




Sweet Grass 


Salt Lake City 


(®& 


Teton 


Salt Lake City 


vi# 


Toole 


Salt Lake City 


Viir"- 


Treasure 


Salt Lake City 




Valley 


Salt Lake City 




Wheatland 


Salt Lake City 




Wibaux 


Salt Lake City 


1 


Yellowstone 


Salt Lake City 






■mm 

■sr£i 



•ft: 

# 
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EFFECTIVE: 11/03/95 
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24-2.28 NEBRASKA 



All counties covered by the office at Omaha. 



.$& 
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EFFECTIVE: 08/27/90 
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24-2.29 



NEVADA 



All counties covered by the office at Las Vegas. iResident 
agency(s) listed has direct mail service. 



COUNTY 

Churchill 
Douglas 
Elko 
.Eureka 



Humboldt 
Lander 
Lyon 
Mineral 
Pershing . 
Storey 
Washoe 
White Pine 



COVERED BY 
OFFICE (RA) 



Las Vegas 
Las Vegas 
Las Vegas 
-_Las_Vegas, 
Las Vegas 
Las Vegas 
Las Vegas 
Las Vegas 
Las Vegas 
Las Vegas 
Las Vegas 
Las Vegas 



(Reno) 
(Reno) 
(Reno) 
_(Reno)_ 
(Reno) 
(Reno) 
(Reno) 
(Reno) 
(Reno) 
(Reno) 
(Reno) 
(Reno) I 












•#;' 






:-■<>■ 



EFFECTIVE: 11/03/95 



■*t 



24-2.30 



NEW HAMPSHIRE 



All counties covered by the office at Boston. 



EFFECTIVE: 08/27/90 
24-2.31 NEW JERSEY 



, «"A.'.V 






|A11 counties covered by the office at Newark except 
Camden, Gloucester, and Salem, which are handled by Philadelphia. 






EFFECTIVE: 09/21/81 
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24-2.32 



NEW MEXICO 






All counties covered by the office at Albuquerque. 
Resident agency(s) listed has direct mail service. 



COUNTY 

Dona Ana 
Grant 
Hidalgo 
Luna 



Otero 
Sierra 



COVERED BY 
OFFICE (RA) 



Albuquerque 
Albuquerque 
Albuquerque 
Albuq uerque 
Albuquerque 
Albuquerque 



EFFECTIVE: 03/14/97 



(Las Cruces) 

(Las Cruces) 

(Las Cruces) 

( Las Cruces ) 

(Las Cruces) 

(Las Cruces) 



■-ja"' 



M 



■■■# 



■>%-:. 



24-2.33 



COUNTY 



NEW YORK 



Resident agencies followed by RA have direct mail service. 



COVERED BY 
OFFICE (RA) 







Albany 

Allegany 

Bronx 

Broome 

Cattaraugus 

Cayuga 

Chautauqua 

Chemung 

Chenango 

Clinton ' 

Columbia 

Cortland 

Delaware 

Dutchess 

Erie 

Essex 

Franklin 

Fulton 

Genesee 



Albany 

Buffalo 

New Rochelle 

Albany 

Buffalo 

Albany 

Buffalo 

Buffalo 

Albany 

Albany 

Albany 

Albany 

Albany 

New Rochelle 

Buffalo 

Albany 

Albany 

Albany 

Buffalo 



s- 



J'*3s. 
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Greene 
| (Hamilton 


Albany 




Albany | - ■ 




Herkimer ■ 


Albany -~ 




Jefferson 


Albany 




Kings 


Brooklyn-Queens - RA 




Lewis 


Albany j 




Livingston 


Buffalo 




Madison 


Albany 




Monroe 


Buffalo 




Montgomery 


Albany 




Nassau 


Long Island - RA 




New York 


New York 




' Niagara 


Buffalo 




Oneida 


Albany 




Onondaga 


Albany 




Ontario 


Buffalo 




Orange 


New Rochelle 




Orleans 


Buffalo 




Oswego 


Albany 


d 


Otsego 


Albany 


Putnam 


New Rochelle 


Queens 


Brooklyn-Queens - RA 




Rensselaer 


Albany 




Richmond 


Brooklyn-Queens - RA 




Rockland 


New Rochelle 




St . Lawrence 


Albany 




Saratoga 


Albany 




Schenectady 


Albany 




Schoharie 


Albany 




Schuyler 


Buffalo 




Seneca 


Buffalo 




Steuben 


> Buffalo 




Suffolk 


Long Island - RA 




Sullivan 


. New Rochelle 




Tioga 


Albany 




Tompkins 


Albany ' 




Ulster 


Albany 




Warren 


Albany 




Washington 


Albany 




Wayne 


Buffalo 




Westchester 


New Rochelle 




Wyoming 


Buffalo 




Yates 


Buffalo 


m 



















. .•4.'. 



Mi 









'2% 



Mi 



m 

■■■:/?• 
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24-2.34 NORTH CAROLINA 



. £*£ KB- 

V'qf 






All counties covered by the office at Charlotte. 



EFFECTIVE: 01/31/78 



24-2.35 NORTH DAKOTA 



■m 



All counties covered by the office at Minneapolis. 






■:.3 



EFFECTIVE: 01/31/78 



24-2.36 



OHIO 



|Resident agencies listed have direct mail service. 




I COUNTY 

Adams 
Allen 
Ashland 
Ashtabula 

[ Athens 
Auglaize 

j Belmont 
Brown 

| Butler 
Carroll 
Champaign 
Clark 
Clermont 
Clinton 
Columbiana 
Coshocton 
Crawford 



COVERED BY 
OFFICEl (RA) 



Cincinnati 

Cleveland 

Cleveland 

Cleveland 

Cincinnati 

Cleveland 

Cincinnati 

Cincinnati 

Cincinnati 

Cleveland 

Cincinnati 

Cincinnati 

Cincinnati 

Cincinnati j 

Cleveland 

Cincinnati | 

Cleveland 



(Columbus) 
(Columbus) 
(Dayton) I 



(Day t on) 
(Dayton) 



(Dayton) | 
(Columbus) 
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Cuyahoga 
| Darke 

Defiance 
| Delaware 
Erie 

Fairfield 
Fayette 
Franklin 
Fulton 
Gallia 

Geauga 

Gre ene 

Guernsey 

Hamilton 

Hancock 

Hardin 
| Harrison 

Henry 

Highland 

Hocking 

Holmes 

Huron 

Jackson 

Jefferson 

Knox 

Lake 

Lawrence 

Licking 

Logan 

Lorain 

Lucas 

Madison 

Mahoning 

Marion 

Medina 

Meigs 

Mercer 

Miami 

Monroe 

Montgomery 

Morgan r 

Morrow 

Muskingum 

Noble. 

Ottawa 

Paulding 



.&'*> 



-tj- 



Cleveland 

Cincinnati 

Cleveland 

Cincinnati 

Cleveland - 

Cincinnati 

Cincinnati 

Cincinnati 

Cleveland 

Cincinnati 

Cleveland 

Cincinnati 



Cincinnati 
Cincinnati 
Cleveland 
Cleveland 
Cincinnati 
Cleveland 
Cincinnati 
Cincinnati 
Cleveland 
Cleveland 
Cincinnati 
Cincinnati 
Cincinnati 
Cleveland 
Cincinnati 
Cincinnati 
Cincinnati 
Cleveland 
Cleveland 
Cincinnati 
Cleveland 
. Cleveland 
Cleveland 
Cincinnati 
Cleveland 
Cincinnati 
Cincinnati 
Cincinnati 
Cincinnati 
Cincinnati 
Cincinnati 
Cincinnati 
Cleveland 
Cleveland 



| (Dayton) | 

| (Columbus) | 

(Columbus) 
(Columbus) 
(Columbus) 

(Columbus) 

_(Day.ton)J__ 
(Columbus) 



[ (Columbus) 
(Columbus) 



(Columbus) 
(Columbus) 



(Columbus) 
(Dayton) I 



(Columbus) 



(Columbus) 

(Dayton) | 

(Columbus) 

(Dayton) | 

(Columbus) 

(Columbus) 

(Columbus) 

(Columbus) 
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Perry 

Pickaway 

Pike 

Portage 
[ Preble 

Putnam 

Richland 

Ross 

Sandusky 

Scioto 

Seneca 
4_Shelby_ 

Stark 

Summit 

Trumbull 

Tuscarawas 
[ Union 

Van Wert 

Vinton 

Warren 

Washington 

Wayne 

Williams 

Wood 

Wyandot 
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(Columbus) 
(Columbus) 



Cincinnati 
Cincinnati 
Cincinnati 
Cleveland . 
Cincinnati | (Dayton) | 
Cleveland 
Cleveland 
Cincinnati 
Cleveland 
Cincinnati 
Cleveland 
_J Cincj nna t i_ j _(Day_ton)_|_ 
Cleveland 
Cleveland 
Cleveland 
Cleveland 

Cincinnati | (Columbus) 
Cleveland 
Cincinnati 
Cincinnati 
Cincinnati 
Cleveland 
Cleveland 
Cleveland 
Cleveland 



(Columbus) 
(Dayton) | 
(Columbus) | 



EFFECTIVE: 11/03/95 



24-2.37 OKLAHOMA 
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All counties covered by the office at Oklahoma City. 



■■vM: 






EFFECTIVE: 09/21/81 
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24-2.38 OREGON 




All counties covered by the office at Portland. 



Sensitive 
PRINTED: 02/18/98 

























^3s" 












. :*$%■■ 






<*??■■ 






■ y«. 






•">£> 






'7TT- 






wfc. 






■t-M 






' 1i.\ ■ 






. . ^;i;v 






■' 'ZA\ 












" ' li'*!Z 






- .: AjSifci. 






' ' '" ; ^$. 




















■ * >'"^' 






"^ii+T •- *F*\f 






- *-'r-l- -■ -•* -•■ 








'l.' -H Wl' 














,::&?' 


_; 


*\ 




jt 


,..: ■ 


"1 






, ' 


•■ '• 






■IV 









Sensitive 



•-•■ n^r" --f- 



^S-"^: 

<-,^. }):•?> 



K&5%- 



Manual of Investigative Operations and Guidelines 
Part II- :•-,". ■--■ • 



EFFECTIVE: 09/21/81 
24-2.39 PENNSYLVANIA 
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II 




The following counties in New Jersey are covered by the 
office at Philadelphia: Camden, Gloucester, and Salem. Resident- 
agency(s) listed has direct mail service. 



j;ounty_ 



Adams 
Al 1 egheny 
| Armstrong 

Beaver 
J Bedford 

Berks 
| Blair 
Bradford 
Bucks 

Butler 
| Cambria 

Cameron 

Carbon 

Centre 

Chester 

Clarion 
| Clearfield 

Clinton 

Columbia 

Crawford 

Cumberland 

Dauphin 

Delaware 

Elk 

Erie 

Fayette 

Forest 

Franklin 

Fulton 

Greene 

Huntingdon 

Indiana 

Jefferson . 



COVERED BY 
0FFICE_(RA)_ 



Philadelphia 
Pittsburgh . 
Pi t ts burgh J (Monongahel a | Val 1 ey) 
Pittsburgh 

Pittsburgh} (Monongahela) Valley) 

Philadelphia 
Pittsburgh] (Monongahela | Valley) 

Philadelphia 

Philadelphia 

Pittsburgh 

Pittsburgh! (Monongahela | Val ley) 
Philadelphia 
Philadelphia 
Philadelphia 
Philadelphia 
Pittsburgh 

Pittsburgh} (Monongahela | Val ley) 
Philadelphia 
Philadelphia 
Pittsburgh 
Philadelphia 
Philadelphia 
Philadelphia 
Pittsburgh 
Pittsburgh 

PittsburghJ(Monongahela|Valley) 

Pittsburgh 

Philadelphia 

Philadelphia 
Pittsburgh] (Monongahela | Valley) 

Philadelphia 
Pittsburghl (Monongahela Valley) 
Pittsburgh] (Monongahela Valley)' 
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Juniata',;; 
. Lackawanna 
Lancaster. ■' 
Lawrence ' " ; 
Lebanon 
Lehigh 
Luzerne ' 
Lycoming 
, McKean 
Mercer 
Mifflin 
Monroe 



Montgomery 

Montour 

Northampton 

Northumberland 

Perry 

Philadelphia 

Pike 

Potter 

Schuylkill 

Snyder 

Somerset 

Sullivan 

Susquehanna 

Tioga 

Union . 

Venango 

Warren 

Washington 

Wayne 

Westmoreland 

Wyoming 

York 



Philadelphia "" -*-;.- 
.Philadelphia ' 
Philadelphia 
. Pittsburgh 
Philadelphia 
Philadelphia 
Philadelphia 
Philadelphia 
Pittsburgh 
Pittsburgh 
Philadelphia 
Philade lphi a 
Philadelphia 
Philadelphia 
Philadelphia 
Philadelphia 
Philadelphia 
Philadelphia 
Philadelphia 
Philadelphia 
Philadelphia 
Philadelphia 
Pittsburgh] (Monongahel a | Valley) 
Philadelphia 
Philadelphia 
Philadelphia 
Philadelphia 
Pittsburgh 
Pittsburgh 

Pittsburgh) (Monongahela | Valley) 

Philadelphia 
Pittsburgh! (Monongahe la j Valley) 

Philadelphia 

Philadelphia " 



. ■:.«,■-*«* .1 ■ •■&■.'■.&■ '. ui „ v '..-. . .-.'-,>;?. :- ■■ . >;-'**;&& 
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EFFECTIVE: 03/14/97 
24-2.40 RHODE ISLAND 

All counties covered by the office at Boston. 
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24-2.41 SOUTH CAROLINA 



All counties covered by the office at Columbia. 



EFFECTIVE: 01/31/78 





24-2.42 SOUTH DAKOTA 

All counties covered by the office at Minneapolis. |The 
Pierre RA has supervisory responsibility over all counties and has 
direct mail service. 



EFFECTIVE: 11/03/95 



24-2.43 



COUNTY 

Anderson 

Bedford 

Benton 

Bledsoe 

Blount 

Bradley 

Campbell 

Cannon 

Carroll 

Carter 

Cheatham 

Chester 

Claiborne 

Clay 

Cocke 



TENNESSEE 

|Resident agencies listed have direct mail service. 

COVERED BY 
0FFICE|(RA)| 

Knoxville 

Knoxville | (Chattanooga) | 
Memphis 

Knoxville | (Chattanooga) | 
Knoxville 

Knoxville] (Chattanooga) | 

Knoxville 

Memphis | (Nashville) | 

Memphis 

Knoxville J (Johnson City) | 

Memphis j (Nashville) | 

Memphis 

Knoxville | (Johnson City) | 
Memphis | (Nashville) | 
Knoxville| (Johnson City) I 






' 1 -V 



".*( ' 



*■ r. 












■A3! 
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| Coffee 
Crockett 
Cumberland 
Davidson 
Decatur 
De Kalb 
Dickson 
Dyer 
Fayette 
Fentress 
Franklin 
_Gibson 
Giles 
Grainger 
Greene 
Grundy 
Hamblen 
Hamilton 
Hancock 
Hardeman 
Hardin 
Hawkins 
Haywood 
Henderson 
Henry 
Hickman 
Houston 
Humphreys 
Jackson 
Jefferson 
Johnson 
Knox 
Lake 

Lauderdale 
Lawrence 
Lewis 
Lincoln 
Loudon 
Macon 
Madison 
Marion 
Marshall 
Maury 
McMinn 
McNairy 
Meigs 



Knoxville| (Chattanooga) 
Memphis 

Memphis (Nashville) 
Memphis (Nashville) 
Memphis 

Memphis (Nashville) I 
Memphis (Nashville) [ 
Memphis 
Memphis 

Memphis | (Nashville) | 
Knoxvi 1 1 e | Chattanooga) 
.Memphis. 
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Memphis | (Nashville) 



(Johnson City) 
(Johnson City) 
(Chattanooga) | 
(Johnson City) , 
(Chattanooga) | 
(Johnson City) | 



(Nashville) 

(Nashville) 

(Nashville) 

(Nashville) 

(Johnson City) 
(Johnson City) 



Knoxvi lie 

Knoxville 

Knoxvi lie 

Knoxville 

Knoxville 

Knoxville 

Memphis 

Memphis 

Knoxville | (Johnson City) 

Memphis 

Memphis 

Memphis 

Memphis 

Memphis 

Memphis 

Memphis 

Knoxville 

Knoxville 

Knoxville 

Memphis 

Memphis 

Memphis (Nashville) 

Memphis (Nashville) 

Knoxvi lie | (Chattanooga) 

Knoxville, 

Memphis) (Nashville) | 

Memphis 

Knoxvi lie | (Chattanooga) 

Memphis I (Nashville) 

Memphis | (Nashville) 

Knoxville | (Chattanooga) 

Memphis 

Knoxvi lie | (Chattanooga) | 
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Monroe 

Montgomery 

Moore 

Morgan 

Obion 

Overton 

Perry 

Pickett 

Polk 

Putnam 

Rhea 

Roane. 



Robertson 

Rutherford 

Scott 

Sequatchie 

Sevier 

Shelby 

Smith 

Stewart 

Sullivan 

Sumner 

Tipton 

Trousdale 

Unicoi 

Union 

Van Buren 

Warren 

Washington 

Wayne 

Weakley 

White 

Williamson 

Wilson 



Knoxville ' ' 

Memphis | (Nashville) | 
Knoxville| (Chattanooga) 
Knoxville 
Memphis 

Memphis) (Nashville) | 
Memphis 

Memphis | (Nashville) J 
Knoxville| (Chattanooga) | 
Memphis | (Nashville) | 
Knoxville | (Chattanooga) j 
-Knoxville 



Memphis I (Nashville) 

Memphis | (Nashville) 

Knoxville 

Knoxville (Chattanooga) | 

Knoxville (Johnson City) 

Memphis 

Memphis I. (Nashville) 

Memphis | (Nashville) 

Knoxville | (Johnson City) 

Memphis | (Nashville) | 

Memphis 

Memphis | (Nashville) | 

Knoxville | (Johnson City) 

Knoxville 



Knoxville 

Knoxville 

Knoxville 

Memphis | (Nashville) 

Memphis 



(Chat tanooga) 
(Chattanooga) 
(Johnson City) | 



Memphis 
Memphis 
Memphis 



(Nashville) 
(Nashville) 
(Nashville) 
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24-2.44 TEXAS ^ 
' |Resident agencies liited have direct mail service. 



COUNTY 

Anderson 

Andrews 

Angelina 

Aransas 

Archer 



Armstrong 

Atascosa 

Austin 

Bailey 

Bandera 

Bastrop 

Baylor 

Bee 

Bell 

Bexar 

Blanco 

Borden 

Bosque 

Bowie 

Brazoria 

Brazos 

Brewster 

Briscoe 

Brooks 

Brown 

Burleson 

Burnet 

Caldwell 

Calhoun 

Callahan 

Cameron 

Camp 

Carson 

Cass 

Castro 

Chambers 

Cherokee 

Childress 

Clay 
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COVERED BY 
OFFICE|(RA)| 

Dallas) (Tyler) | 

El Paso 

Dallas | (Tyler) j 

Houston] (Corpus Christi) 
5ali^iForlJ*orth)J__ 

Dallas] (Lubbock) | 

San Antonio 

Houston 

Dallas | (Lubbock) | 

San Antonio 

San Antonio 

Dal las | (Fort Worth) j 

Houston) (Corpus Christi) | 

San Antonio 

San Antonio 

San Antonio 

Dallas) (Lubbock) | 

San Antonio 

Dallas] (Piano) | 

Houston | (Texas City)] 

Houston 

El Paso 

Dallas] (Lubbock) | 

Houston] (Corpus Christi) | 

Dallas | (Lubbock) | 

San Antonio 

San Antonio 

San Antonio 

Houston] (Corpus Christi) | 

Dallas | (Lubbock)] 

San Antonio | (McAllen) | 

Dallas (Piano) | 

Dallas (Lubbock) | 

Dallas (Piano)] 

Dallas (Lubbock) | 

Houston | (Texas City) | 

Dallas 

Dallas] (Lubbock) ] 

Dallas | (Fort Worth) | 
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Cochran ■ 
Coke 
Coleman 
Collin . 
Collingsworth 
Colorado 
Comal 
Comanche 
Concho 
Cooke 
Coryell 
-Cottle 
Crane 
Crockett 
Crosby 
Culberson 
Dallam 
Dallas 
Dawson 
Deaf Smith 
Delta 
Denton 
De Witt 
Dickens 
Dimmit 
Donley 
Duval 
Eastland 
Ector 
Edwards 
Ellis 
El Paso 
Erath 
Falls 
Fannin 
Fayette 
Fisher 
Floyd 
Foard 
Fort' Bend 
Franklin 
Freestone 
Frio 
Gaines 
Galveston 
Garza 



Dallas 
Dallas 
Dallas 
Dallas 
Dallas 
Houston 



(Lubbock) 
(Lubbock) 
(Lubbock) 
(Piano) | 
(Lubbock) | 
(Texas City) 
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San Antonio 
Dallas (Lubbock) 
Dallas (Lubbock) 
Dallas (Piano) | 
San ( Antonio 

—Dallas |_(Fort_Wor.th)_ 
El Paso 

Dallas! (Lubbock) 
Dallas I (Lubbock) 
El Paso 

Dallas | (Lubbock) | 

Dallas 

Dallas (Lubbock) I 

Dallas (Lubbock) I 

Dallas (Piano) I 

Dallas (Piano) | 

Houston | (Corpus Christi) 

Dal las | (Lubbock) | 

San Antonio 

Dallas | (Lubbock) | 

Houston | (Corpus Christi) 

Dallas | (Lubbock) | . 

El Paso 

San Antonio 

Dallas 

El Paso 

Dai las | (Fort Worth) | 

San. Antonio 

Dallas | (Piano) | 

Houston | (Texas City) | 

Dallas (Lubbock) I 

Dallas (Lubbock) J 

Dallas (Fort Worth) | 

Houston 

Dallas | (Piano) | 

San Antonio 

San Antonio 

Dal las | (Lubbock) | 

Houston) (Texas City) | 

Dallasj (Lubbock) I 
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Karnes 
Kaufman 
Kendall 
Kenedy 





Gillespie 


San Antonio 




• 




I Glasscock . 


. Dallas) (Lubbock) | 


' 1 Goliad 


Houston) (Corpus Christi)) 


Gonzales 


San Antonio 




Gray 


Dallas 


(Lubbock) | 




Grays on 


Dallas 


(Piano) 






Gregg 


Dallas 


(Tyler) 




Grimes 


Houston 


Guadalupe 


San Antonio 


1 Hale 


Dallas 


(Lubbock) ) 


1 Ball 


•Dallas 


(Lubbock) 




-.Hamilton 


Cam A-.*-—— -?_ 




— — O 3X1 _ All 


lunio 




Hansford 


Dallas 


(Lubbock) | 




Hardeman 


Dallas 


(Fort Worth) 1 




Hardin 


Houston | (Beaumont) | ' 


Harris 


Houston ,■ 




Harrison 


Dallas 


(Tyler) | 




Hartley 


Dallas 


(Lubbock) 






Haskell 


Dallas 


(Lubbock) 




/^%. Ha y* 


San Antonio 


V# 


Hemphill 


Dallas 


(Lubbock) ) 


ViiP^ 


Henderson 


Dallas 


(Tyler) | 




Hidalgo 


San Antonio 1 (McAllen) 






Hill 


San Antoniol (McAllen) 






Hockley 


Dallas 


(Lubbock) | 




Hood 


Dallas 


(Fort Worth) | 




Hopkins 


Dallas 


(Piano) | 


Houston 


Dallas 


(Tyler) | 


1 Howard 


Dallas 


(Lubbock) | 


Hudspeth 


El Paso 




Hunt 


Dallas 


(Piano) | 




Hutchinson 


Dallas 


(Lubbock) [ 




Irion 


Dallas 


(Lubbock) | 




. Jack 


Dallas 


(Fort Worth) ) 




Jackson 


Houston 


(Texas City) | 




Jasper 


Houston 


(Beaumont) 1 


Jeff Davis 


El Paso 


| Jefferson 


Houston) (Beaumont) | 


Jim Hogg 


San Antonio 




Jim Wells 


Houston.) (Corpus Christi)! 




Johnson 


Dallas 


(Forth Worth) | 




Jones 


Dallas 


(Lubbock) 


1 







San Antonio 

Dallas 

San Antonio 

Houston 



'"; -temp. 
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Kent 

Kerr 

Kimble 

King 

Kinney 

Kleberg 

Knox 

Lamar . 

Lamb 

Lampasas 

LaSalle 

Lavaca 
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Lee 

Leon 

Liberty 

Limestone 

Lipscomb 

Live Oak 

Llano 

Loving 

Lubbock 

Lynn 

Madison 

Marion 

Martin 

Mason 

Matagorda 

Maverick 

McCulloch 

McLennan 

McMullen 

Medina 

Menard 

Midland 

Milam 

Mills 

Mitchell 

Montague 

Montgomery 

Moore 

Morris. 

Motley 

Nacogdoches 

Navarro 

Newton 

Nolan 



Dallas | (Lubbock) | 
San Antonio 
,San Antonio 
Dallas | (Fort Worth) | 
San Antonio 

Houston| (Corpus Christi) 
Dallas (Fort Worth) | 
Dallas (Piano) | 
Dallas (Lubbock) | 
San Antonio 
San Antonio 

Housto n[ (T exas Cit y)] ._ 

San Antonio 

San Antonio 

Houston | (Beaumont) | 

San Antonio 

Dallas | (Lubbock) | 

Houston | (Corpus Christi) | 

San Antonio 

El Paso 

Dallas (Lubbock) 

Dallas (Lubbock) 

Houston 

Dallas | (Tyler) | 

El Paso 

San Antonio 

Houston | (Texas City) 

San Antonio 

San Antonio 

San Antonio 

San Antonio 

San Antonio 

Dallas | (Lubbock) | 

El Paso 

San Antonio 

Dallas (Lubbock) I 

Dallas (Lubbock)) 

Dallas (Fort Worth) | 

Houston 

Dallas (Lubbock) | 

Dallas (Piano) | 

Dallas (Lubbock) | < 

Dallas (Tyler) | 

Dallas 

Houston) (Beaumont) | 

Dallas | (Lubbock) I 
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Nueces 
Ochiltree 
Oldham 
Orange 
Palo Pinto 
Panola 
Parker 
Parmer 
Pecos , 
Polk 
Potter 
..Pres idi o 
Rains 
Randall 
Reagan 
Real 
| Red River 
Reeves 
Refugio 
Roberts 
Robertson 
Rockwall 
Runnels 
Rusk 
Sabine 

San Augustine 
San Jacinto 
San Patricio 
San Saba 
Schleicher 
Scurry 
Shackelford 
Shelby 
Sherman 
Smith 
Somervell 
Starr 
Stephens 
Sterling 
Stonewall 
Sutton 
Swisher 
Tarrant 
Taylor 
Terrell 
J Terry 



Houston | (Corpus Christi) 

Dallas! (Lubbock) I 

Dallas! (Lubbock) J 

Houston | (Beaumont) | 

Dallas (Fort Worth) I 

Dallas (Tyler) | 

Dallas (Fort Worth) | 

Dallas (Lubbock) | 

El Paso 

Houston | (Beaumont) | 
Dallas | (Lubbock) | 

_El_Paso. _____ 

Dallas (Tyler) | 
Dallas (Lubbock) 
Dallas (Lubbock) 
San Antonio 
Dallas | (Piano) | 
El Paso 

Houston) (Corpus Christi) 

Dallas | (Lubbock) | 

San Antonio 

Dallas (Piano) | 

Dallas (Lubbock) | 

Dallas (Tyler) | 

Houston (Beaumont) 

Houston (Beaumont) 

Houston 

Houston | (Corpus Christi) 

San Antonio 

Dal las 

Dallas 

Dallas 

Dallas 

Dallas 



(Lubbock) 
(Lubbock) 
(Lubbock) 
(Tyler) | 
(Lubbock) | 
Dallas (Tyler) | 
San Antonio 
San Antonio) (McAllen) | 
Dallas (Lubbock) 
Dallas (Lubbock) 
Dallas (Lubbock) 
(Lubbock) 
(Lubbock) 
(Fort Worth) 
(Lubbock) 
San Antonio 
Dal las | (Lubbock) 



Dallas 
Dallas 
Dallas 
Dallas 
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Throckmorton 

Titus 

Tom Green 

Travis 

Trinity 

Tyler ■• 

Upshur 

Upton 

Uvalde 

Val Verde 

Van Zandt 

Victoria 

Walker 

Waller 

Ward 

Washington 

Webb 

Wharton 

Wheeler 

Wichita 

Wilbarger 

Willacy 

Williamson 

Wilson 

Winkler 

Wise 

Wood 

Yoakum 

Young 

Zapata 

Zavala 



Dallas 
Dallas 
Dallas 
San Antonio 



(Lubbock) | 
(Piano) | 
(Lubbock) | 



Houston (Beaumont) 

Houston (Beaumont) 

Dal las | (Tyler) | 

El Paso 

San Antonio 

San Antonio 

Dal las | (Tyler) | 
JgoustonJ jCprp us Christ i) 

Houston 

Houston 

El Paso 

San Antonio 

San Antonio 

Houston | (Texas City) | 

Dallas (Lubbock) | 

Dallas (Fort Worth) 

Dallas (Fort Worth) 

San Antonio| (McAllen) 

San Antonio 

San Antonio 

El Paso 



Dallas 

Dallas 

Dallas 

Dallas 

San Antonio 

San Antonio 



(Fort Worth) | 
(Tyler) | 
(Lubbock) j 
(Fort Worth) | 
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All counties covered by the office at Salt Lake City. 



EFFECTIVE: 01/31/78 



Sensitive 
PRINTED: 02/18/98 



■X£f( 



. -lip 

' - ' ■•& 

■ ■#$$■ 
; -#SwK" 






•i-iW»ft» 




Sensitive 



Manual of Investigative Operations and Guidelines 
Part II 



24-2.46 



PAGE 24 - 44 



VERMONT 












All counties covered by the office at Albany, N.Y. 






EFFECTIVE: 01/31/78 



24-2.47 




CITY 



VIRGINIA 

Re s i denLag enc i e s_l i s.t e d_have_d_i_re.c. t^mai_Hng_add_^sse s. 
INDEPENDENT CITIES 

COVERED BY 
OFFICE (RA) 



'-# 




| .Alexandria 
Bedford 
Bristol 
Buena Vista 
Charlottesville 
Chesapeake 
Clifton Forge 
Colonial Heights 
Covington 
Culpeper 
Danville 
Emporia 
Fairfax 
, Falls Church 
Franklin 
Fredericksburg 
Galax 
Hampton 
Harrisonburg 
Hopewell 
I Leesburg 
Lexington 
Lynchburg 
j Manassas 
Martinsville 
Newport News 
Norfolk 
Norton 



Washington|Field Office (WFO) 
Richmond 
Richmond 
Richmond 

Richmond (Fredericksburg) 
Norfolk 
Richmond 
Richmond 
Richmond 
R i chmond 
Richmond 
Richmond 
WFO 
WFO 

Norfolk 

Richmond (Fredericksburg) 
Richmond 
Norfolk 

Richmond (Fredericksburg) 
Richmond 
WFO| 

Richmond 
Richmond 
WFO | 

Richmond 
Norfolk 
Norfolk 
Richmond 



... "V 
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Petersburg • 

Portsmouth 
( Quantico 

Radford 

Richmond 
' Roanoke 

Salem 

South Boston 

Staunton 

Suffolk 
| Vienna 

~-V_i rg in i a_B each. 

| Warrenton 
Waynesboro 
Williamsburg 
Winchester 
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Richmond -. 

Norfolk 

| WFO | 

Richmond 

Richmond 

Richmond 

Richmond 

Richmond 

Richmond (Fredericksburg) 

Norfolk . 
fWFOJ 
.Norfolk 
|WFO| •~~ 

Richmond (Fredericksburg) 

Norfolk 

Richmond (Fredricksburg) 



■.m 






-m>- 






COUNTIES 



%■ 




COUNTY 

Accomack 
Albemarle 
Alleghany 
Amelia 
Amherst 
Appomattox 
| Arlington 
Augusta 
Bath 
Bedford 
Bland 
Botetourt 
Brunswick 
Buchanan 
Buckingham 
Campbell 
Caroline 
Carroll 
Charles City 
Charlotte 
Chesterfield 
Clarke . 
Craig 
Culpeper 



COVERED BY 
OFFICE (RA) 

Norfolk 

Richmond (Fredericksburg) 
Richmond 
Richmond 
Richmond 
Richmond 
|WFO| 

Richmond (Fredericksburg) 

Richmond 

Richmond 

Richmond 

Richmond 

Richmond 

Richmond 

Richmond 

Richmond' 

Richmond (Fredericksburg) 

Richmond 

Richmond 

Richmond 

Richmond 

Richmond (Fredericksburg) 

Richmond 

Richmond (Fredericksburg) 
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Cumberland 

Dickenson 

Dinwiddle 

Essex 

Fairfax 

Fauquier 

Floyd 

Fluvanna 

Franklin 

Frederick 

Giles 

Gloucester 




Goochland. 

Grayson 

Greene 

Greensville 

Halifax 

Hanover 

Henrico 

Henry 

Highland 

Isle of Wight 

Janes City 

King and Queen 

King George 

King William 

Lancaster 

Lee 
| Loudoun 
Louisa 
Lunenburg 
Madison 
Mathews 
Mecklenburg 
Middlesex 
Montgomery 
Nansemond 
Nelson 
New Kent 
Northampton 
Northumberland 
Nottoway 
Orange 
Page 
Patrick 
Pittslyvania 
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Richmond 

Richmond 

Richmond (Fredericksburg) ~ 

WFO 

WFO 

Richmond 

Richmond (Fredericksburg) 

Richmond 

Richmond (Fredericksburg) 

Richmond 

Norfolk 



Richmond 

Richmond 

Richmond (Fredericksburg) 

Richmond 

Richmond 

Richmond 

Richmond 

Richmond . 

Richmond (Fredericksburg) 
Norfolk 
Norfolk 

Richmond (Fredericksburg) 
Richmond (Fredericksburg) 
Richmond 

Richmond (Fredericksburg) 
Richmond 
JWF0| 

Richmond (Fredericksburg) 
Richmond 

Richmond (Fredericksburg) 
Norfolk 
Richmond 

Richmond (Fredericksburg) 
Richmond 
Norfolk 

Richmond (Fredericksburg) 
Richmond 
Norfolk 

Richmond (Fredericksburg) 
Richmond 

Richmond (Fredericksburg) 
Richmond (Fredericksburg) 
Richmond 
Richmond 
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Powhatan 


Ri 


chmond 


Prince Edward 


Richmond 


Prince George 


Richmond 


| Prince William 


|WFO| • 


Pulaski 


Richmond 


Rappanhannock 


Richmond (Fredericksburg) 


Richmond 


Richmond (Fredericksburg) 


Roanoke 


Richmond 


Rockbridge 


Richmond 


Rockingham 


Richmond (Fredericksburg) 


Russell 


Richmond 


Scott 


Richmond 


Shenandoah 


Richmond (Fredericksburg) 


Smyth 


Richmond 


Southampton, 


Norfolk 


Spotsylvania 


Richmond (Fredericksburg) 
|WFO| 


| Stafford 


Surry 


Richmond 


Sussex 


Richmond 


/^ Tazewell 


Richmond 


y ; $ Warren 


Richmond (Fredericksburg) 


^*^ Washington 


Richmond 


Westmoreland 


Richmond (Fredericksburg) 


Wise 


Richmond 


Wythe 


Richmond 


York 


Norfolk 


AGENCIES 






CIA 


WFOl 




Pentagon 


WFOJ 


AIRPORTS 






Dulles International J 


WFO 






National j 


WFO 





"■~3&x* 
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■.-% 



' Vs. v 






. fit 




MILITARY BASES 



Dahlgren Naval Station 
Fort A. P. Hill 
Fort Monroe 
| Navy Annex 



Richmond (Fredericksburg) 
Richmond (Fredericksburg) 
Norfolk 
[WFOl 



■ i:.i;. 



Sensitive . 
PRINTED: 02/18/98 













Sensitive 



Manual of Investigative Operation and Guideli 
Part II" , 



nes 



EFFECTIVE: 03/14/97 



24-2.48 WASHINGTON 







. - * 


■. ,. L , _„ 








- ' 'f ■ . 




















\l\ 




>" " *V*&~ 




t \ T^FJ*. 





■ -<. v-S i.p£*- 




:■ ■; y^t* 








..,.,... ■■ -^i... 






* 


■ : M® 
1 VCSS? 


. 




\ 


'- .*$* 




» 




1 v>5J2?/.' 








^""-Sjg* 








'.'.„';*§iS|^ 






* 


'■ Tfr^fSS/ 








--VT^iX 






'. , 












PAGE 


24 - 


48: 




-.- 




,n 4*.-. .. 


.'. T " L _?:>^^ V 








■*Mf 



All counties covered by the office at Seattle 
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WEST VIRGINIA 



H » e ,'^ - A11 """tie. covered by the office at Pittsburgh. 
Resident agency(s) listed has direct mail service. 



COUNTY 

Barbour 
Berkeley 
Braxton 
Brooke 
Calhoun 
Doddridge 
Gilmer 
Grant 
Hampshire 
Hancock 
Hardy 
Harrison 
Jefferson 
Lewis 
Marion 
Marshall 
Mineral 
| | Monongalia | 
Morgan 
Ohio 

Pendleton 
Pleasants 
Pocahontas 
Preston 
Randolph 



COVERED BY 
OFFICE (RA) 



Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 

Pittsburgh 



(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
(Monongahela Valley) 
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Ritchie. 

Taylor 

Tucker 

Upshur 

Webster 

Wetzel 



Pittsburgh 
Pittsburgh 
Pittsburgh 
Pittsburgh 
Pittsburgh 
Pittsburgh 



(Monongahela 
(Monongahela 
(Monongahela 
(Monongahela 
(Monongahela 
(Monongahela 



mes 



Valley) 
Valley) 
Valley) 
Valley) 
Valley) 
Valley) 
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EFFECTIVE: 03/19/97 



24-2.50 WISCONSIN 






All counties covered by the office at Milwaukee. 



EFFECTIVE: 08/27/90 



24-2.51 WYOMING 



■:*&■ 






I v.ii™ ► All counties covered by the office at Denver except 
I Yellowstone National Park, covered by | Salt Lake City. | 



% 



EFFECTIVE: 08/27/90 
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POSSESSIONS AND COMMONWEALTHS 







EFFECTIVE: 08/27/90 



24-3.1 GUAM 



Guam covered by the office at Honolulu. 
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24-3.2 



Honolulu. 
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NORTHERN MARIANAS 



Commonwealth of Northern Marianas covered by office at 
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PUERTO RICO 




Juan. 



Commonwealth of Puerto Rico covered by the office at San 
EFFECTIVE: 08/27/90 



'$•• 



24-3.4 



VIRGIN ISLANDS 



Virgin Islands covered by the office at San Juan. 



EFFECTIVE: 08/27/90 
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STATE 

Alabama 

Alaska 

Arizona 

Arkansas 

California 

Colorado 

Connecticut 

Delaware 



STATE CAPITOLS 



CAPITAL 

Montgomery 

Juneau 

Phoenix 

Little Rock 

Sacramento 

Denver 

Hartford 

Dover 



COVERED BY 
OFFICE AT 

Mobile 
Anchorage 
Phoenix 
Little Rock 
Sacramento 
Denver 
New Haven 
Baltimore 
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Florida 
Georgia 
Hawaii 
| Idaho 
Illinois 
Indiana. 
Iowa 

Kansas 

Kentucky , 

Louisiana 

Maine 
— Maryland. 



Massachusetts 

Michigan 

Minnesota 

Mississippi 

Missouri 

Montana 

Nebraska 
:~ Nevada 
$ New Hampshire 

New Jersey 

New Mexico 

New York 

North Carolina 

North Dakota 

Ohio 

Oklahoma 

Oregon 

Pennsylvania 

Rhode Island 

South Carolina 

South Dakota 

Tennessee 

Texas 

Utah 

Vermont 

Virginia 

Washington 

West Virginia " 

Wisconsin 

Wyoming 



Tallahassee 

Atlanta 

Honolulu 

Boise 

Springfield 

Indianapolis 

Des Moines 

Topeka 

Frankfort 

Baton Rouge 

Augusta 
Annapo 1 i s 

Boston 

Lansing 

St. Paul 

Jackson 

Jefferson City 

Helena 

Lincoln 

Carson City 

Concord 

Trenton 

Santa Fe 

Albany 

Raleigh 

Bismarck 

Columbus 

Oklahoma City 

Salem 

Harrisburg 

Providence 

Columbia 

Pierre 

Nashville 

Austin 

Salt Lake City 

Montpelier 

Richmond 

Olympia 

Charleston 

Madison 

Cheyenne ' 



Jacksonville 

Atlanta 

Honolulu 

| Salt Lake City) 
Springfield 
Indianapolis 
Omaha 

Kansas City 

Louisville 

New Orleans 

Boston 
Baltimor e 

Boston 

Detroit 

Minneapolis 

Jackson 

Kansas City 
(Salt Lake City | 

Omaha 

Las Vegas 

Boston 

Newark 

Albuquerque 

Albany 

Charlotte 

Minneapolis 

Cincinnati 

Oklahoma City 

Portland 

Philadelphia 

Boston 

Columbia 

Rapid City 

Memphis 

San Antonio 

Salt Lake City 

Albany 

Richmond 

Seattle 

Pittsburgh 

Milwaukee 

Denver 
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24-5 UNITED STATES- MEXICO BORDERS''"* ;*'\" 



J«t°S'?i. r T Mt ' £ ° r inVesti « ations > foreign countries should be 
sent to the Bureau. 



EFFECTIVE: 11/03/95 
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24-6 



FOREIGN COUNTRIES 



|Territorial allocation details are no longer maintained in 
the manuals. An up-to-date listing is available in the FOIMS Tables/ 
Application, "Territorial Allocation, Foreign Territorial Allocation 



App 
options 



'—jar- 
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EFFECTIVE: 11/16/93 
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FEDERAL BUREAU OF INVESTIGATION 

FOBPA — 

DELETED PAGE INFORMATION SHEET "X- 

Page(s) withheld entirely at this location in the file. One or more of the following statements, where indicated, ,8&. 



/ explain this deletion. 



/, 
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26-2 



GENERAL CLASSIFICATION INSTRUCTIONS 



When material is prepared in the FBI which relates to 
national security and which meets the criteria of Executive Order 
12356, it must be classified and marked in accordance with the 
provisions of that Order as outlined in this section. Information may 
be classified or reclassified after an agency has received a request 
for it under the Freedom of Information Act or the Privacy Act, if 
such classification meets the requirements for classification and ..is 
accomplished personally and on a document-by-document basis by an 
individual with original Top Secret classification authority. 
Information shall not be declassified automatically as a result of any 
unofficial publication or inadvertent or unauthorized disclosure in 
the United States or abroad of identical or similar information. The 
Attorney General may reclassify information previously declassified 
and disclosed if it is determined in writing that (1) the information 
requires protection in the interest of national security; and- (2) the 
information may reasonably be recovered. These reclassification 
actions shall be reported promptly to the Director of the Information 
Security Oversight Office (ISOO) . See ISOO Directive Number One, 
Section 2001.6 for reporting requirements. T - 
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26-2.1- Authority to Classify, Declassify, Upgrade and Downgrade .„• 



2vA- 



(1) Classification may be accomplished through use of a 
prepared guide which contains instructions for its use and which j- 
details the information to be classified, lists the classifying 
authority, and shows the level of classification and the length of 
time to remain classified. An example of such a guide is 
"Classification Guide No. 1" (G-l) regarding Foreign Government 
Information. 

r ■ 

(2) Information may also be classified by incorporating, 
-paraphrasing, -restating, -or- generating-in-new-forminformation-that is 

already classified. This type of classification, including the use of 
classification guides, is known as "derivative classification." If 
previously classified information is used as the basis for 
classification, the previous markings must be honored and the original 
source documents must be shown on the "Classified by" line in a manner 
that will afford retrieval of the source document. Information to be 
classified which is not classified derivatively may only be classified 
by an individual having the authority to classify and in accordance 
with procedures set forth hereinafter. 

(3) Authority to classify (or upgrade) material is 
strictly limited to specifically designated officials and supervisors 
approved in writing by the Attorney General. Such approval is handled 
through the Security|Clearances |Unit, Security [Countermeasures | 
Section, I Intelligence (Division, at FBIHQ. 







(A) Agents or support personnel preparing national 
ty material should determine whether there is a basis for 
fication, the level of classification, and the reasons, but only 
ized classifiers may approve such classification (unless it is 
tive classification), and only their credential numbers may be 
s the classifying authority. . In the absence of an authorized 
fier, an individual not authorized, such as a relief supervisor,. 

on authorized classifier's behalf, nay classify material 
ing the authorized classifier's credential number. 

(5) Classified material may be downgraded or declassified 
only by the original classifying authority, by a successor acting in 
the same capacity, by a supervisory official of either, or by ■ -■. : .-.; 
officials, delegated such authority in writing by the FBI Security 
Programs Manager. The successor or supervisory official need not be a 
classifying authority to downgrade or declassify. Information 
classified derivatively by classification guides may be downgraded or 
declassified by Special Agents in Charge and Senior Legal Attaches. 
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(6) Those individuals in the FBI who have been designated f<V.j» 
as Original Top Secret Classification Authorities may not redelegate, - 
that (or a lesser) classification authority., - ' ' 

(7) The Attorney General of the United States has 
established the Department Review Committee (DRC) (see 28, Code of 
Federal Regulations (CFR) , Section 17.135) as Department of Justice's 
(DOJ's) component responsible for the resolution of all issues 
concerning the implementation and administration of Executive Order 
12356 which concerns national security material. The DRC is composed 

of re presen tatives from various com p onents within DOJ. inc luding the — 
FBI. Classification actions are discussed and voted upon. The DRC may 
vote to uphold the FBI classification action or may vote that 
classification is not warranted. The DRC. will review and resolve all 
issues, concerning a number of FBI classification actions, which, in 
part, may relate to: 




i*rfSS5* 




(a) Administrative appeals of requests for records 
under the Freedom of Information Act (Title 5, USC, Section 552) and 
mandatory reviews for declassification when the FBI's proposed denial 
of information to the requestor is based upon national security 
concerns; 

(b) All classified material which will require the 
submission of an affidavit or declaration to the Court to justify the 
nondisclosure of national security information pursuant to Freedom of 
Information/Privacy Acts (FOI/PA) exemptions or assertion of a "State 
Secret Claim." 

The Document Classification Unit (DCU) , Security Section (SS) , 
Information Management Division (IMD) , is responsible for liaison with 
the DRC and should be consulted in connection with any submission of 
material to the DRC. 
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For material to be "considered f ^classif ication,' it must|, ■ , .^ 
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26-2.2.2 Damage Requirement 

Information that is determined to concern one or more of-. 
• -"« ?fi-2 2 1 shall be classified when an original - - 
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26-2.2.3 Reason for Classifying Otherwise Unclassif iable Material 
in Context of Other Material 

(1) Certain information which would otherwise be 
unclassified when standing alone (such as an FD-302, address, or the 
like), may require classification when combined or associated with 
other unclassified or classified information. In the context where 
this no rmal ly_unclassi_f ie A J ^nlorjwli_on_wou U j^e^l_^ujii^y est i gatiye 

v - .' « * j* * .^ * _s i_ ■ -. — ~^.-*i ***** 1 ^.m « ■ ««• i»ftnfl1ripft . fherehv 
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"interest in certain individuals, organizations, or countries, thereby 
causing the information now to fall within one of the criteria listed 
in 26-2.2.1 above, such as an intelligence activity or method, and it 
meets the criteria in 26-2.2.2, it should be classified. 

(2) As a rule, the above basis for classification will be 
used infrequently inasmuch as the vast majority of classifiable FBI 
information will be readily identifiable as falling within the 
categories of (a) foreign government information, (b) intelligence 
sources, activities, or methods, or (c) foreign relations. Whenever 
the information's deemed to warrant classification based on the above 
reason (since it is not readily apparent that it falls within the 
26-2.2.1 criteria), a reference must be made to the above reason on 
the face of the document. This will be accomplished by adding a line 
below the "Classified by " line as follows: 

Classified by 

Reason for Classification: FCIM II, 1-2.2.3 
Declassify on: OADR 

(3) The above does not apply to situations where the date 
of the communication, the page number, and otherwise innocuous 
information warrants classification on the basis that the entire 
document should be classified to protect the fact that the FBI has an 
investigation concerning that matter. 
















,, -fc. 



1*2" 



n 



, ; V 



:.-• r 



EFFECTIVE: 09/26/90 




Sensitive 

PRINTED: 02/ 18/98. .^.^^ 



i-j- "..:n?r ■■ ,..,-fi^.^\ 






. j. m m m»< ii j w » ' . w^» y wy 





Sensitive 



Manual of Investigative Operations and Guidelines 



PAGE 26 - 



26-2.3 



Classification Guidance 









Section 26-2.2.1, supra, identified the categories of 
information that shall be considered for classification. Of the 
categories listed, those most likely to be encountered by FBI 
classifiers are: 




b^ 



To assist classification authorities in rendering classification 
determinations concerning this information, the following guidance is 
supplied: 
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□ Information pertained only to a third party with no reference to the subject of your request or. the subject of your 
request is listed in the title only. 

• □ Documents originated with another Government agency(ies). These documents were referred to that agency(ies) 









for review and direct response to you. 

Pages contain information furnished by another Government agency(ies). You will be advised by the FBI as .^ 
to the releasability of this information following our consultation with the other agency(ies). jt|. 
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Page(s) withheld inasmuch as a final release deterrnination has not been made. You will be advised as to the. || 
disposition at a later date. ? '£; 



Pages were not considered for release as they are duplicative of , 
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1)26-2.4' Categories (Levels) of Classification 

(1) There are three categories or levels of 
classification: "Top Secret," "Secret," and "Confidential." 

(a) "Top Secret" shall be applied to information, 
the unauthorized disclosure of which reasonably could be expected to 
cause exceptionally grave damage to the national security. 

(b) "Secret" shall be applied to information, the 
unauthorized disclosure of which reasonably could be expected to 
caiise_8erip-"g— damage to the n ational secur ity. , 
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(c) "Confidential" shall be applied to information, 
the unauthorized disclosure of which reasonably could be expected to 
cause damage to the national security. 

(2) If there is reasonable doubt about the need to 
classify information, it shall be safeguarded as if it were 
classified pending a determination by an original classification 
authority, who shall make this determination within thirty (30) days. 
If there is reasonable doubt about the appropriate level of 
classification, it shall be safeguarded at the highest level of 
classification pending a determination by an original classification 
authority, who shall make this determination within thirty (30) days. 
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26-2.5 



Duration of Classification 



Information shall be classified as long as required by 
national security consideration. The phrase "Originating Agency's 
Determination Required," as indicated by the abbreviation "OADR," will 
be utilized to show the duration of classification, except in those 
rare instances where there is a clear determination the information 
can be declassified on a specific date or event. 
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Classification Markings 
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(1) The following markings must be shown on the front , 
page of all classified documents, except teletypes, which will be 
covered separately: 

(a) Classification level ("Top Secret," "Secret," or 
"Confidential") at the top and bottom of: the front cover, if any; '. 
the title page, if any; the first page; the last page; the reverse 
side of the last page or coyer. In addition, each interior page must 
be marked at the top and bottom according to the highest overall level 
_of_classification_of_the„entire_document... _^_____ __ 



(b) The identity of the classifying authority 
(credential number), classification guide number, or source document 
(if derivative) . 

(c) The notation, "Declassify on: Originating 
Agency's Determination Required", or "OADR," unless there is a clear 
determination the information can be declassified on a specific date 
or event. In the vast majority of cases, OADR will apply. 

Example: Classified by (credential number) 
Declassify on: OADR 

(d) In instances where the identity of the 
originating agency and office are not apparent on the face of a 
document, the identity of the originating agency must be placed below 
the "Classified by" line (ISOO Dir. No. 1, Section 2001.5 (c)). This 
situation would occur most frequently at FBIHQ in classifying other 
Government agency information, such as an INS record. The FBI would 
be considered the originating agency for the classification decision 
in this instance and would have to be so noted. If this addition 
warrants classification, the portion should be marked accordingly. 

(2) An ISOO booklet entitled "Marking," which is 



Unit, Security 
FBIHQ, [contains 



available from the | Information Systems Security 

Countermeasures Section, Intelligence Division, 

detailed, yet simple, instructions and examples on marking classified 

documents. . 
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(3) When material is classified solely because of other 
agency data, it must be appropriately marked to correspond with the 
other agency's markings. 

(4) When classified material i» downgraded, upgraded or 
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declassified, a line will be drawn through the previous level of 
classification and related markings, and the new level, along with 
"upgraded," "downgraded" or "declassified," noted adjacent thereto, 
together with the date and credential number of the declassifier or 
classification authority, whichever is appropriate. 



EFFECTIVE: 10/14/93 
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26- 2.6.1 Internal Documents Prior to 1974 



Prior to 1974, classification markings were not included 
on classifiable internal FBI documents. All such documents, when 
subject to disclosure, must be reviewed and appropriately marked for 
classification. 





EFFECTIVE: 03/23/92 



26-2.6.2 Marking of Separate Documents and Transmittal Documents 

FBI reports have two parts, the cover page(s) and the 
report itself. For classification purposes, each part must be 
considered separately and marked appropriately. There will be 
instances when the cover page(s) is classified but not the report, and 
vice versa. Each part-, must indicate the level of classification, 
identity of the classifying officer, declassification date, etc. 
Similarly, a transmittal document, such as a cover letter/.airtel to an 
LHM, a form letter, or a routing slip must be considered separately 
and'marked accordingly. An unclassified transmittal document must be 
marked top and bottom of the front page with the highest 
classification level of any information transmitted by it. It must 
also be marked with an appropriate instruction indicating it is 
unclassified when separated from classified enclosure(s) . If the 
transmittal document itself contains classified information, mark it 
as required for all other classified information, except: 

(1) conspicuously mark the top and bottom of the front 
page of the transmittal document with the highest classification level 
of any information contained in the transmittal document or its 
enclosures; and 

(2) mark the transmittal document with an appropriate 
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instruction indicating its overall classification level when separated "V ''.•'■ " 'W 
from its enclosures. >. . < . ' 
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26-2.6.3 Marking Separate Paragraphs | (See MIOG, Part II, ;f; 

16-18.8.2(2), 16-18.8.13(5); Correspondence Guide-HQ, ■ C# 

1-4.1(3); Correspondence Guide-Field, 1-21.1(3); FCIM, 

Part^ II . 1-2.6.3. ) | __ 
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(1) Whenever portions of classified material require ~gg&. 
different levels of classification, then each paragraph or portion - '3^ 
must be marked to show its classification or that it is unclassified. - j|||| 
(A "portion" includes the title or subject, as well as a paragraph, $%- 
sentence or word of a communication.) In marking individual portions, i,|t 
the appropriate marking ("Top Secret," "Secret," "Confidential," or J. 
"Unclassified") should be typed in parentheses immediately following \^M- 
the portion in question. Abbreviations may be used (TS, S, C, or U) . j;|| ; 
An introductory caveat, such as "This document is classified 'Secret' 
in its entirety, unless otherwise noted," may be used when the 
majority of the document is at the same level, thereby requiring only 
the portions that differ to be marked. A similar statement should be 

used to show the document is classified in its entirety, if that is ^ 

the case. | (See (2) below.) | *$fi£ 

(2) The FBINET subnetwork is authorized to process up to 
and including SECRET/col lateral data. Under no circumstance may TOP 

SECRET (TS) or Sensitive Compartmented Information (SCI) be processed ^ 

by FBINET, or entered into any Automated Information System (AIS) ' I*gj 

which is accessed by FBINET. AISs which utilize the FBINET subnetwork ** 

include: the Field Office Information Management System (FOIMS) ; the v . 
Resource Management System (RMS); the | Criminal Law Enforcement 7^. 

Application (CLEA) ; | the Criminal Law Enforcement System (CLES) ; the , '%' 

Investigative Support Information System (ISIS); the Uniform Crime r*||g 

Reporting System (UCRS) ; the Legal Counsel Information System (LCIS) ; ^ '^ 

and, the Training Division Support System (TDSS)'. To ensure ^ 

compliance with this restriction, all correspondence containing TS or 
SCI data will be "portion marked" to show specific classification 
levels (i.e., title, each paragraph, etc.) Although a document may 
have an overall classification of TS and/or SCI, frequently the 
information to be entered into the AIS may actually be classifiable at 
a lower level. Portion marking will allow for that information which 
is classified as SECRET/col lateral or Jbelow (if any) to be entered 
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into AISs accessed by the FBINET subnetwork. Under no circumstanc 
may SCI, regardless of classification level, be processed on the 
FBINET subnetwork or entered into any AIS accessed by the FBINET ■* 
subnetwork. However, SCI material can be appropriately downgraded 
based on the approval of the originating agency, to the .. 
SECRET/CONFIDENTIAL collateral level through written summaries, et 
so it may be processed via FBINET.. (Also see MIOG, Part II, Secti 
26-2.6.3(1).) 
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26-2.6.4 Marking Teletypes 

Teletypes are marked with the classification level 
("UNCLAS" or "UNCLAS E F T 0," if unclassified) preceding the text on 
the first page and at the top of each succeeding page. ^ 

abbreviation "C BY ? DECL: OADR" will be utilized at the end 

of the message on teletypes. 



EFFECTIVE: 03/23/92 



26-2.6.5 Marking Derivatively Classified Documents Being 
Disseminated Outside the FBI 

When documents are being disseminated outside the FBI and 
have been classified derivatively, they should be treated as follows: 

(1) If the derivative source is a single document, mark 
the outgoing copies "Classified by Derivative Source," and identify 
the source document on all FBI copies. 

(2) If the derivative source is multiple documents or 
sources, mark the outgoing copies "Classified by Multiple Sources," - 
and identify the multiple sources on all FBI copies. 
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26-2.7 Material With Different Classification Levels or 
Declassification Dates 

When classified material consists of two or more items of 
information which bear different classification levels or 
declassification dates, the following guidelines apply: 

(1) Material containing different levels of classified 
information must be classified at the level of the highest classified 
component. 

-(2)--Mat-erial-containing-different- declassification-dates- 
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must be marked with the most distant declassification date. 
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SPECIAL CLASSIFICATION INSTRUCTIONS 
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The procedures set forth above will not cover all 
situations involving classification matters. It is emphasized that 
the objective is to protect national security material in our files in 
a practical and reasonable manner. In connection with any problems 
not covered in these instructions which cannot be handled locally, the 
Security | Clearances | Unit, Security|Countermeasures | Section, 
|lntelligence|Division, should be consulted. Following are some 
special classification instructions representing classification 
decisions that have already been made and should be adhered to. 



EFFECTIVE: 02/12/92 









126-3.1 



Classification of Notes , 




(1) When a note containing classified information is 
affixed to a communication that is unclassified, they should be 
treated as a single document and marked accordingly. In actual 
practice, this would mean that the original communication going, to 
the field would be unmarked and would bear no reference to any 
classified material, whereas the FBIHQ copies containing the note 
would be classified and marked accordingly. The classified document 
would either have to be portion-marked or contain a caveat to the 
effect that all portions are unclassified unless otherwise noted. 
This caveat should not appear on the original unclassified document. 
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(2) When classified enclosures are added to the above-. 



■r, •><•..', 



example, each package should be treated separately. The markings on'l%;;J 
each transmittal letter would be handled in accordance with ; v . 
instructions set forth in 26-2.6.2 above. 



(3) For variations of the above 
original and note are both classified, but a 
same logic would apply, i.e., they would be 
document. The reasoning behind treating the 
as a single document is because, generally, 
_the_same_time_by_the_8ame._person_.and_are_.not 
separately. In the event a note is added to 
time by someone other than the originator of 
has the responsibility to ensure proper clas 
followed with respect to the note.) 
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such as when the c . 

t different levels, the 

treated as a single 
note and communication 

they are both prepared at 

int ended _to_be_utilized 

a document at a later 
the document, that person 

sification procedures are 



* J *'' | 26-3.2 



Classification of Addenda and; Attachments to Documents 



(1) The intent behind Executive Order 12356 is that the 
individual generating information meeting the criteria for 
classification has the responsibility for ensuring that it is properly 
classified. In the situation where addenda are added to a 
communication by someone other than the originator, that person has 
the responsibility of ensuring that this information is properly 
classified. Even though an addendum is not likely to be used 
separately, it should still, be marked as separate document, notwith- 
standing the fact that it might be numbered as if it were a single -^ 
document. The key element is that it represents another individual's 
thought, and that individual has the responsibility to classify it. 

It would, therefore, be possible for a memorandum to be classified 
"Secret" in its entirety, one addendum to be "Unclassified," and 
another to be classified in part. - - 

(2) Consideration should be given always to the." '*'t ■[ 
possibility that an otherwise unclassified addendum might warrant"' 
classification by virtue of it being linked with a classified *".. 
memorandum. • If the originator of the memorandum determines an" 
addendum prepared by another individual should have been classified, 
he/she has the prerogative to classify it. 

(3) Since each component is to be marked as a separate 
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a memorandum, Vuch'as "Al 1 ' ■ V f {v^(^ 



document, a notation oh the first page of 

information contained herein is classified "Secret" unless otherwise 
noted," would apply only to the memorandum and not to any attachments 
or addenda. Likewise, the "Secret" markings at the top and bottom of- 
each page of the memorandum should not be applied to the attachments 
or addenda unless they also are "Secret." They should be marked at 
the appropriate level of classification of the newly created 
document (s) . 

(4) In situations where memoranda with addenda attached 
are,' being reviewed for classification, such as pursuant to a Freedom 
jit^Inf^riMitijva^^tj^w^i.i-^M^hlv^^-^Q!^ be treated as__a__8eparate_ 
document to avoid confusion and enhance uniformity. 
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FEDERAL BUREAU OF INVESTIGATION 

FOIPA ' 

DELETED PAGE INFORMATION SHEET 

'-'■.: _ ;■•/'*£ 

Page(s) withheld entirely at this.location in the file. One or more of the following statements, where indicated,"* 
explain this deletion. 

2\ Deletions were made pursuant to the exemptions indicated below with no segregable material available for 
release to you. 
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)( (b)(2) 




□ (b)(7)(B) 


n (b)(3) 
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□ (b)(7)(D) 
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□ (b)(7)(E) 


D (b)(7)(F) 


□ (b)(4) 
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Section 552a 
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(d)(5) 
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(kX2) 
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00(3) 
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00(4) 
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00(5) 
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00(6) 
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00(7) 




D Information pertained only to a third party with no reference to the subject of your request or the subject of your 
request is listed in the title only. 

□ Documents originated with another Government agency(ies). These documents were referred to that agency (ies) 
for review and direct response to you. 

Pages contain information furnished by another Government agency(ies). You will be advised by the FBI as 

to the releasability of this information following our consultation with the other agency(ies). 

Page(s) withheld inasmuch as a final release determination has not been made. You will be advised as to the 

disposition at a later date. 

Pages were not considered for release as they are duplicative of 

Page(s) withheld for the following reason(s): 




>S The following number is to be used for reference regarding these pages: 

_ rnioQ rvnonr 




XXXXXX 
XXXXXX 
XXXXXX 



XXXXXXXXXXXXXXXX 
X Deleted Page(s) X 
X No Duplication Fee X 
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26-4 



ACCESS TO CLASSIFIED INFORMATION BY INDIVIDUALS HAVING 
OFFICIAL CLEARANCES 







All FBI employees are cleared for access to classified 
national security material up to and including "Top Secret" on a 
strict need-to-know basis. No individual is to be permitted access to , 
classified or classifiable material appearing in the files of the FBI 
unless they have been afforded official clearance for such access and 
have a need to know. It will be incumbent upon each FBI employee 
permitting such access to be assured the required clearance has been 
obtained. Questions as to whether an individual is cleared for access 
to national security material which cannot be resolved locally are to. 
be referred to the Security Programs Manager at FBIHQ; Any instance 
of unauthorized access or attempted unauthorized access to national 
security material should be promptly reported to Director, FBI, 
Attention: Security Programs Manager. 
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[26-4.1 Inadvertent Unauthorized Access to National Security 
Information 

(1) In cases where national security information has been 
disclosed to an individual who has not had appropriate clearance(s) or 
has inadvertently had unauthorized access to national security 
information, that individual, once interviewed and briefed as to 
his/her responsibilit y and_oMjga_U^iLjioJLlg_dJj^l^s^ 



security information, is to sign and date the Inadvertent Disclosure 
Statement, Form FD-722. This form provides an affirmation suitable 
for execution by any individual who has inadvertently obtained 
national security information. The form is to be witnessed by the FBI 
representative present. An individual who does not wish to sign the 
FD-722 should be briefed as to its contents. The reason for refusal 
should be noted on the form, which will then be appropriately 
witnessed. 

(2) The original and one copy of the executed FD-722 are 
to be forwarded to FBIHQ, Attention: Security Programs Manager, as 
enclosures to a self-explanatory cover memorandum.! 



EFFECTIVE: 05/26/89 



26-5 



STORAGE OF CLASSIFIED MATERIAL | (See MIOG, Part I, .261-2 
(3) (a), (4) (a); Part II, 16-7.2.6 (9) (g) , 35-9.4.9; NFIPM, 
Part 1, 8-5; Correspondence Guide - Field, 1-21.7.) 

Introduction 

Classified material, including classified information on 
storage media used by typewriters, word processors, or remote 
terminal equipment, shall be protected at all times. Whenever 
classified material is not under the personal control (observable and 
sufficiently close to prevent unauthorized access) of an authorized 
and appropriately cleared person, whether during or outside of 
working hours, it will be guarded or stored in a locked security 
container, as described herein, or a secure storage room, as 
described in Section 26-5.2. FBI employees are responsible for the 
protection and storage of classified information and material in 
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their custody. It is the responsibility of the holder of classified n 
material to ensure that material is properly protected and, through ;.. 
verification of clearance/access" and need to know, not provided to an 
individual who is neither authorized nor cleared to receive it. 
Storage equipment not functioning in a normal manner shall be 
immediately reported to the appropriate Security Countermeasures 
Program Manager or Security Officer for corrective action. The 
adjustment or repair of security equipment will be accomplished only 
by trained personnel. Until repairs have been made, defective 
equipment shall not be used to safeguard classified items.] . 



.-■*«fB^- 

.-\-1':mS, 






*5' 



.'Ida. 



EFFECTIVE: 09/09/97 



^vi 



•*& 




26-5.1 Storage of "Top Secret" Material | (See MIOG, Part II, 
35-9. A. 9; NFIPM, Part 1, 8-5.1; MAOP, Part II, 
2-4.3.1 (l)(k); Correspondence Guide - Field, 1-21.7.) 

"Top Secret" materi al Imust I be stored_in aJ^eneral^SerVj 
Admi nistrat ^^^^^^^^^^^^^^^^^^^^^^^ 

-AeT^enngencies^Lega^ttachWITicesTand field office ant 
FBlH Q off-site facilities are not authorized to process or maintain 
"Top Secret" material or. information unless approved in writing by 
the Security Programs Manager, National Security Division, FBIHQ. | All 
"Top Secret" material must be segregated from general files, whether 
pending or closed, and stored in|approved containers.! 0nly|FBI| 
employees |and other specified personnel with a verified security 
clearance and | a "need to know" shall have access to "Top Secret 
material. 
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26-5.2 



Storage of "Secret" and "Confidential" Material 
| (See MIOG, Part II, 26-5, 35-9.4.9; NFIPM, Part 
1, 8-5.2; Correspondence Guide - Field, 1-21.7.) 



"Secret" and "Confidential" material must be stored in 
r.KA-anorove d security containers having__GSAiapp_royed > 

— r ' — ^— ™""^^^^^^^^^^»y' secret^ and 

Confidential" v inrorTR5 , ffon%ay i ,be openly stored <,not in a GSA- 
approved safe) in TVe'cure" storage room which has been approved in 
accordance with specific Department of Justice requirements. 
Although similar in construction, these secure facilities are not 
Sensitive jCompatLtment_ed_Jnior m Upj!^ — - 

approved for the storage of Sensitive Compartmented Information (SCI) 
at any level of classification. The approval for a secure storage 
room for the open storage of classified material must be obtained in 
writing from the Security Programs Manager, National Security 
Division, FBIHQ. Access to "Secret" and "Confidential" material is 
limited to appropriate personnel with a verified security clearance 
and a need to know. 
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26-5 2.1 Storage of "Sensitive Compartmented Information (SCI)" 
(See NFIPM, Part 1, 8-5.2.1; MAOP, Part II, 2-4.3.1 
(1) 00 5 Correspondence Guide - Field, 1-21.7.) 



(1) SCI is classified information (Confidential, Secret, 
or Top Secret) concerning or derived from intelligence sources, 
methods, or analytical processes, which is required to be handled 
within formal access control systems established by the Director of 
Central Intelligence (DCl) . SCI is sometimes referred to as 
"codeword" material. 

(2) The Director of Central Intelligence Directive (DCID) 
1/21 entitled "Physical Security Standards for Sensitive 
Compartmented Information Facilities (SCIFs)," requires that all SCI 
be stored, processed, or discussed within an accredited SCIF. 
Accreditation is the formal affirmation that the proposed facility 
meets applicable physical security standards as set forth in DCID 
1/21. The accreditation for a SCIF must be obtained in writing from 
the Security Programs Manager, FBIHQ. For further information 
regarding the handling of SCI, contact a representative of the 
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26-5.3 Removal of Classified Material to Residence 

(1) Employees may not remove classified material from 
official premises to their residence during nonworking hours ""hoot 
approval f ro*^he^rjLctor,_lhe_mW}^iS^ 

"the SAcTor FBI "field offices, or the appropriate Assistant Director 
at FBIHQ. In every instance of approval, the material removed must 
remain in the- personal control of the authorized employee at all times 
unless a safe and an alarm are installed in the residence by the FBI. 
Before installing any such equipment in a residence, the SPM at FBIHy 
should be contacted for guidance. 

(2) Control files are to be established, both at FBIHQ 
and in the field offices, to document those requests to remove 
classified material to an employee's residence. The file will include 
the date and duration of the request, the justification, signature 
approval granting or denying the request, the name of »•«»•»»* 
individual, and a description of the classified material being charged 

out. 

(3) This authority does not apply to Legats. 
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126-5 4 Proper Use and Changing of Lock Combinations and Disposal 
* of Combination Locks/Security Equipment (see also Part II, 
Section 16-7.2.6(9) of this manual) 

(1) Except as otherwise noted, it shall be the 
responsibility of the supervisory or management official using or 
overseeing the use of security equipment that appropriate 

administrative controls are in place to ensure compliance with all 



requirements set forth herein 
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(4) Records of combinations must be classified no lower 
than the highest category of classified material stored in the 
involved security equipment and must be protected in accordance with 
established guidelines addressing the handling and storage of NSI. 

(a) A central Combination Record File is to' be 
established in each division, Legat, regional computer center, or 
other off-site Bureau component, and combinations for all security 
containers used to store classified material are to be maintained in 
this file. This file is to be securely maintained in a fashion 
commensurate with the highest classification level of any document in 
the file. 

(b) Standard Form (SF) 700, entitled "Security 
Container Information," is to be completed each time a combination is 
changed. This is a three-part, self-explanatory form. Upon 
completion,. Part 1 is to be affixed to the inside of the affected v 
vault, safe, door, or security container. Part 2A is to be completed 
and sealed inside Part 2, an envelope designed for this purpose, which 
in turn, is to be maintained in the central Combination Record File. . 

(c) It shall be the responsibility of the individual 
Legats and Security Officers to ensure all combination records for all 
equipment used to store classified material are properly classified 
and maintained.' 

(d) Written records of combinations must be 
maintained only as described herein. They are not to be retained in 
either "coded" or "uncoded" form on the person of any employee or 
othej individual -having access to the affected security equipment, nor 
are they "to be recorded in any form on index cards, calendars, 
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notebooks, "etc., which are not being maintained in compliance with 
established guidelines set forth herein for the protection ° f Jj SI « 

(5) Combinations shall be changed only by persons having 
the appropriate security clearance and/or special access, if 
applicable, for the type of classified material stored in the security 
container. The same shall apply to the Security Officer (SO), 
Alternate Security Officer (ASO) , or any other individual designated 
to accompany this person. Clearances/special accesses may be verified 
by SOs or other designated individuals throueh_th*_ off ice of the 
Security Programs Manager, FBIHQ, Extension^ 



La* «» V. Nr V i# •■• w 

mghtheof 



(a) In field offices, resident agencies, and off 
site locations associated with a field office, all combination changes 
are to be made by a Technically Trained Agent (TTA) and under the 
general direction of the field office SO or ASO. A responsible 
employee designated by the SAC or ASAC and familiar with security 
requirements governing the protection of NSI should also be present 
when the combination is changed. 

(b) In Legats, all combination changes are to be 
made by the Legat, Assistant Legat, or other office personnel 
certified by the Engineering Section (ES) , Technical Services Division 
(TSD). A responsible employee designated by the Legat or Assistant 
Legat and familiar with the security requirements governing the 
protection of NSI should also be present when the combination is 
changed. 

(c) In regional computer centers or other FBI 
components not specifically associated with a field or FBIHQ division, 
all combination changes are to be made by the SO, ASO, or other 
personnel certified by ES, TSD. A responsible employee designated^, 
the administrator of that component or his/her senior assistant and 
familiar with the security requirements governing the protection of 
NSI should also be present when the combination is changed. 

(d) For all FBIHQ divisions, all combination changes 
are to be made by technically trained Bureau personnel certified by 
ES, TSD, and under the general direction of the division SO or ASO. A 
responsible division employee designated by no less than at the Unit 
Chief level and familiar with security requirements governing the 
protection of NSI should also be present when the combination is 
changed. 

(e) The same combination will not intentionally be 
used for more than one lock in any field or FBIHQ division, Legat, 
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regional computer center, or other off-site location. In selecting 
combination numbers, multiples of five, simple ascending or descending 
arithmetical series, personal data (such as birthdates) , and serial 
numbers, must be avoided. Only numbers that are widely separated may 
be used. The last number of a built-in combination lock shall not be 
set between 90 and 20. To prevent a lockout, a new combination is to 
be tried at least three consecutive times before closing the door or 
drawer. 









as 






1 



(f) When security equipment "is* taken out of service, 
it shall be inspected to ensure no classified information or other FBI 
_data_remains.,_and_the_builtr:in_combination_lock..shal l_.be _reset_to_the — 
standard combination 50-25-50. Combination padlocks shall be reset to 
the standard combination 10-20-30. 

(6) To properly secure a combination lock, the dial must 
be turned four or more complete revolutions in the same direction. 
Spinning the dial quickly is to be avoided as it shortens the life 
span of the tumblers /wheels, may cause other damage to the lock, and 
may not properly secure the lock. Combination locks are not to be 
left in an unsecured condition and the combination numbers are not to 
be left predialed to facilitate easy opening after an absence, as such 
a practice defeats the security protection of a combination-locked 
repository. | 
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CONTROL FORM FOR TOP SECRET (TS) - SENSITIVE COMPARTMENTED 
INFORMATION (SCI) - NON-SCI CODE WORD MATERIAL - FD-501 - 
FD-502 




Accountability, receipting and control of. "Top Secret," 
Sensitive Compartmented Information (SCI), and Non-SCI Code Word 
Material within a field office or within FBIHQ is controlled through 
the use of the FBI "Control Form for Top Secret (TS) , Sensitive 
Compartmented Information (SCI), and Non-SCI Code Word Material," 
FD-501. An original of an FD-501 will be attached to each copy of the 
material and the copy of FD-501 will be retained by the Security 
Officer to ensure he/she is aware of the location of the material at 
all times. "Top Secret" and/or Sensitive Compartmented Information 
being transmitted between field offices and/or FBIHQ or to outside 
agencies is controlled through the use of the "Receipt for Top Secret 
(TS) - Sensitive Compartmented Information (SCI) , and Non-SCI Code 
Word Material," FD-502, which is attached to the material while being 
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transmitted.' The recipient of the material will sign and return the 
original FD-502 to. FBIHQ, Room 5991, or the Security Officer of, the. 
transmitting field office. • ■ " 



*~\ 
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EFFECTIVE: 01/18/91 



26-7 



TRANSMITTAL OF CLASSIFIED MATERIAL 



„EFFECTI.VE:_01/18/9.1_ 



26-7.1 



Within Field Offices 






•tic!;- 





Material classified "Top Secret" or containing Sensitive 
Compartmented Information must be hand carried in an envelope within 
field offices. Material classified "Secret" or "Confidential" may be 
routed by messenger within field offices but must be in a messenger 
envelope except when records processing procedures such as indexing, 
serializing, filing, etc., are handled by OSM personnel within a field 
office. 



EFFECTIVE: 01/18/91 



26-7.2 Between Field Offices and/or Resident Agencies, Outside 
Agencies and FBIHQ (See|MI0G, Part II, 35-9.4.14; | 
MAOP, Part II, J2-2. 2.2(1) (d) ; i 

Correspondence Guide-FBIHQ, 1-4.5(4); Correspondence < 
Guide-Field, | 1-21.5(2); and National Foreign Intelligence 
Program Manual, Part I, 8-7.2.) | 

Material classified "Top Secret" or containing Sensitive 
Compartmented Information may only be transmitted between field 
offices and/or resident agencies, outside agencies and FBIHQ by secure 
teletype, by FBI courier designated by the SAC or Security Programs 
Manager or by Defense Courier Service (DCS). | (See Part II, 26-6 above 
for use of control forms.) | Material classified "Secret" or 
"Confidential" must be enclosed in opaque sealed envelopes or in 
opaque sealed boxes and may be transmitted by[United States Postal 
Service (USPS) Registered Return Receipt, USPS Express Mail, or 
Federal Express (FedEx) between FBI offices within the United States 
and Puerto Rico. FedEx (does not deliver to post office boxes. To 
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ensure direct delivery to the addressee, the "Waiver, of Signature and 
Indemnity" block on the |USPS| Express Mail Label, 11-B, and the ; 
"Release Signature" block on the | FedEx |Airb: ill Labe „ mav /^ be 
executed under any circumstances. All "Confidential" and Secret 
express|»ail| S hipments should be (prepared by FBI employees and hand 
delivered directly to a FedEx | representative or a | USPS . 
facility! representative. The use of (collectionlboxes is prohibited. 
For marking of transmittal documents, refer to 26-2.6.2 above. 
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EFFECTIVE :._0.6/jO_6/96_ 



26-7.3 Defense Courier Service (DCS); FBI Courier 

"Top Secret" or Sensitive Compartmented Information which 
cannot be sent by secure teletype between field offices and/or FBIHQ 
must be transmitted by DCS or an FBI courier designated by the SAC or 
Security Programs Manager. "Top Secret" or Sensitive Compartmented 
Information transmitted between field offices and resident agencies or 
to outside agencies within the field office territory must be 
transmitted by an FBI employee designated as a courier by the SAC. 

EFFECTIVE: 01/18/91 

26-7.4 Wrapping Classified Material 

"Top Secret" or Sensitive Compartmented Information 
transmitted bvlDCSlmust be wrapped in accordance with packing 
■ standards set forth in Appendix C, |DCS| Administrations and Operations 
Regulations. "Top Secret" or Sensitive Compartmented Information 
transmitted by FBI employees designated couriers by the SAC and 
"Secret" and "Confidential" material sent by registered mail must be 
enclosed in opaque sealed envelopes where size permits or in opaque 
sealed boxes in accordance with instructions set. forth m Title 28, 
Code of Federal Regulations, Part 17.104. 

EFFECTIVE: 07/23/90 









. J'-v 



Sensitive' •' " -ViW 

PRINTED: 02/18/98 ... / • , , ■...*■„ x [ ^ •. . ■ ' WP^ 




*s • 






Sensitive 



Manual of Investigative Operations and Guidelines 

part ii' - ': . ,..; 



PAGE 26 - 33 



26-8 



MATERIAL CLASSIFIED UNDER PRIOR ORDERS 



■ .. When incorporating information classified under previous 
Executive orders into a new document and no specific declassification 
date was indicated thereon, or if it was marked "indefinite," then a 
date for declassification must be shown or "OADR" (Originating 
Agency's Determination Required). 
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EFFECTIVE: 07/23/90 



26-9 



ATOMIC ENERGY MATERIAL MARKINGS 



Additional warning markings "Restricted Data" and 
"Formerly Restricted Data" are used in connection with atomic 
energy-type material. These markings must be included on the first 
page when such classified material is set forth in FBI-originated 
documents. . 



EFFECTIVE: 07/23/90 
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26-10 



SENSITIVE COMPARTMENTED INFORMATION (SCI) 



,■£*£; 



EFFECTIVE: 07/23/90 
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26-10.1 



Definition of SCI 




(1) SCI access is regulated by the Director of Central 
Intelligence Directive (DCID) No. 1/14. SCI is all information and 
material requiring special U.S. Intelligence Community controls 
indicating restricted handling within present and future Community 
intelligence collection programs and their end products. These 
special Community controls are formal systems of restricted access 
established to protect the sensitive aspects of foreign intelligence 
programs. DCID No. 1/14 establishes minimum personnel security;' 
standards and procedures which govern eligibility for access to SCI. 

(2) SCI security control systems depend upon distinctive 
markings and restricted handling of material, stricter personnel 
security processing for access, and holding SCI material in "Control 
Centers" with physical and procedural barriers to preclude access by 
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those who have not been formally approved. The SCI control systems 
provide an organized program for predetermining a generalized 
"need-to-know" regarding specific categories of intelligence and/or 
the sources and methods employed in their collection. 

(3) SCI systems cover activities and information of 
extraordinary sensitivity and fragility from a security standpoint. 
They serve to restrict access to the protected information to persons 
who have a clearly established "need-to-know. •' "Need-to-know exists 
only when access to SCI is essential to a person for the performance 
of official duties. Personnel granted access to SCI must meet 

ri gor ous_ and^s t singmt_Vj»^pm»l^»»^U^^n^sriA £ _^B^d^iM-- 

cleared for Top Secret information are not automatically eligible for 
access to SCI. 




EFFECTIVE: 07/23/90 



I I 26-10.2 SCI Access|(See MIOG, Part II, 35-9.2.) 




responsibil 
condition o 
which is a 
individual, 
because it 
government, 
constitutes 
prosecution 



(1) Persons indoctrinated for SCI accept certain 
ities and restrictions in a most explicit way. As a 
f access, an individual signs a nondisclosure agreement 
contractual agreement between the government and the 

This agreement should be read carefully before signing, 
states obligations imposed upon the individual and the 
Willful disclosure of SCI to unauthorized individuals 
criminal or administrative offenses which may result in 
or administrative action. 



(2) Access to SCI will be granted when the "need-to-know" 
is established, eligibility determined, SCI nondisclosure. agreement 
(Form | 4A14) | signed, and indoctrination completed. 



EFFECTIVE: 04/10/96 



Sensitive 
PRINTED: 02/18/98 








PAGE 26 "35 



Sensitive 



Manual of Investigative Operations and Guidelines 

'Part II : .v^T : ..i'^ A , ' y ~" ;^*j: . "& ■ ' r" ' ....- ■ AJr'\ 

26-10.2.1 FBIHQ/Field Office/Legat Personnel Security Access 
Certification Procedures >/ 

i " . 

■ * >'• • ' 

DCID No. 1/14 sets forth the minimum personnel security 
standards and procedures governing eligibility for access to SCI. The 
purpose of this Directive is to enhance the security protection of SCI 
through the application of minimum security standards, procedure,, and 
continuing security programs, and to facilitate ^e security 
certification process among government departments and agencies, 

" Accordingly, the following procedures will be followed by 

^FRTJggada uarters (FBIH Q ) and fiel d diyis^ons^hen^cce ss to SCI is ___ 



required: 

(1) A written communication requesting SCI access shall 
be directed to ^National Security Division, | Attention: Security 
Programs Manager (SPM). |The communication should utilize the 
employee's 67 g file number. | The communication shall be captioned as 
follows: 



"ACCESS TO SCI, 



DIVISION." 



The following information shall be included for each 
individual for whom access is being requested: 

A. Bureau name 

B. Position 

C. Social Security Account Number 

D. Supervisor's written certification of employee's 
"need-to-know" 

E. SCI access or" accesses requested 
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|(2)lThe division Security Officer will be advised in ; 
writing of access approval. The written communication will authorize 
Ihe Security Officer to conduct a formal briefing and "purity 
indoctrination in accordance with the minimum. requirements set forth 
in "Annex C," DCID No. 1/14, page | 2. | 

|(3)Form 4414, "Sensitive Compartmented Information 
Nondisclosure Agreement," |. should be executed prior to the formal 
briefing and, thereafter, forwarded to the SPM. 
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In emergency cases where immediate access is required, the 
division Security Officer may, by secure telephone, provide the 
aforementioned information to the Supervisory Special Agent managing 
the SCI Program for the SPM, followed by a routine. teletype confirming 
that information. FBIHQ will expedite access approval by secure • 
telephone. If an exception to the investigative requirements • is 
granted to facilitate an immediate interim access, the prescribed 
J investigation shall, nevertheless, go forward. 

For TURK purposes, these matters will be handled under the 
__67E_classlfjjc.atio,!i,^RgA"y- es tisa tion o£ FBI Pe rsonnel." _____ — _ 
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EFFECTIVE: 04/10/96 







| 26-10.2.2 |Deleted| 



EFFECTIVE: 04/10/96 



26-10.2.3 Denial/Revocation 



■■#_?, 




A denial or revocation of access to SCI shall be in 
accordance with procedures established in "Annex B" to DCID No. 1/14, 
which is titled "Appeals." For purposes of denial or revocation, the 
determination authority for the FBI shall be the SPM. The final 
appeal authority remains with the Director of the FBI or his 
designated representative at the Associate Deputy Director level. 



EFFECTIVE: 12/10/91 
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SCI access must be terminated when an employee no longer 
has a "need-to-know." This can be occasioned by position transfer, 
retirement, resignation, suspension, maternity leave, etc. At this 
time, the Security Officer will debrief the employee, in accordance 
with the guidelines provided in "Annex C," DCID No. 1/14. 
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26-10.2.5 Exceptions to DCID No. 1/14 



Exceptions to the m 
No. 1/14 may be granted only by 
Intelligence Community (SOIC) . 
SOIC is defined aS a head of an 
Community, as defined by Execut 
designated representative. EO 
activities of the United States 
intelligence element of the FBI 
The SOIC for the FBI is the Dir 
responsibility for the administ 
the FBI to the SPM. 



inimum standards as set forth in DCID 

the Senior Official of the 

For the purposes of DCID No. 1/14, an 

organization within the Intelligence 
ive Order (EO) 12333, or their 
12333 defines the intelligence 

and specifically states the 

is part of the Intelligence Community, 
ector, who specifically delegated the 
ration of SCI policy and procedures for 
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EFFECTIVE: 12/10/91 
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|26-10.2.6 Access to Sensitive Compartmented Information (SCI) 
Recertification Procedures, Reinvestigation of FBI 
Personnel (See MIOG, Part I, 67-18(1) (e) .) 

The SCI access mandatory recertification process is to be 
conducted annually by each Security Countermeasures Programs Manager 
(SCMFM) or his/her designee. 

(1) The Security Programs Manager (SPM) , FBIHQ, will 
forward to each field office and FBIHQ division/office a list of 
designated employees with SCI access on or about May 1 of each 
calendar year. 

(2) The list will contain each employee's name, social 
security number, SCI access, briefing date, debriefing date, and 
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(3) Each SCMPM will review, verify, and certify the 
identifiable information pertaining to each employee. 

(a). When a determination is made to continue with 
the SCI access, the SCMPM is required to provide a succinct statement 
justifying the continuation of the SCI access. 

(b) In those instances when the SCI access 
continuance cannot be fully justified, then steps must be initiated to 
debrief the em plo yee immediatel y. 



(c) When an employee is debriefed, a blank copy each 
of Form 4414, entitled "Sensitive Compartmented Information 
Nondisclosure Agreement," and SF-312, entitled "Classified Information 
Nondisclosure Agreement," is to be given to each debriefed employee. 
Both forms are to serve as a reminder of the consequences and 
statutory requirements for protecting national security information. 

(4) The SCMPM is required to maintain a copy of the SCI 
access recertif ication list from year to year. 
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(a) Upon receipt of the current year's list of 
employees, the previous year's list is to be destroyed. 

(b) The list of employees is to be maintained in 
accordance with established procedures for handling and storing , 
Sensitive Compartmented Information. 

(5) The recertif ication list, with appropriate comments 
and debriefing form (Form 4414), should be returned to the SPM within 
60 calendar days from the date of the SPM's cover communication. 

(6) The SCMPM or his/her designee is to ensure those 
employees whose. SCI access is no longer required are debriefed 
routinely. 

(7) Whenever an employee's conduct is no longer 
commensurate with DCID Number 1/14, Executive Order 10450, and/or, the 
employee '8 misconduct impacts on his/her trustworthiness, the SCMPM is 
required to conduct a personnel security interview with the employee -•■*- 
and notify the SPM, FBIHQ, providing a recommendation as to whether 
the employee's SCI access should be suspended, denied, or revoked 
pending the SPM's final adjudicative decision. | 
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EFFECTIVE: 10/12/93 V- T ' 

26-11 CERTIFICATION OF CLEARANCES 



.■ f 



EFFECTIVE: 12/10/91 




26-11.1 



-Yisits_to_ Other. Agencies-by-Current Employees- 



~^m 



«l*nci.. Upon request from the fiel. Security O LI L '"" 
reason for visit. Field 3<.<.tif-;t-« nrc uul '' er . M "w of visit; and 

p«./crt i£y w j;^:tj d .ss y c ? "r.„::. h 'r t n : zir/i&i: t 

other agencies. Frequently, however m *™ It-t £ office to 
and private eeetor e^LioTS n"T a cepV.e.'uHtTcteaT'" 




EFFECTIVE: 12/10/91 






Sensitive • 
PRINTED: 02/18/98 



L *.■»**-. ;'-'. ' 






A**' 
3& 






11 



&%> 

■ 'Twines* 

■-"*<3i 

• -.*..- v.. ■ 



" ■(& 



■ (> i^^l 



JSyiJgTffi 






i? 7. ' .'.— J ..a.l. i rV-.. 1 ' . ■ .J"..; r i^. » 






^*i^^ r'/SW 



■■-■tS%K 







■ " v"*.- : ~*y>,- 



■*ft? 




""*»* 



Manual of Investigative Operations and Guidelines 
Part II '^5Si '•rS> ;■?■ ■. ,-v ':^ J j. .?.-.-.■ :\-f;V • ••• ■ 

W t ? - ^.-'^jfti'-, •■_■ '■ •; ..«*' '•■■■'■ •!•• . '• . " "" 

26-11.2 ■'' Converting FBI Clearances to Clearances for New Employer ^^V;; 

(1) When current or former FBI employees apply for 
positions with other Federal Government agencies or with private *•;;•; 
industry which require security clearances, inquiries concerning their 



Clearances | 
Division. 



FBI security clearances should be directed to the Security 
Unit | (SCU) , | Security | Countermeasures (Section, | Intelligence 
| SCU J personnel should request that all such inquiries be made in. 
writing, to allow for a proper review of the employee's personnel 
file, and any other file that would be pertinent to the request, such 
as an Administrative Inquiry Hatter. 



(2) 



Executive Order (EO) 10450, "Security Requirements 
for Government Employment," mandates, in Section 3(a), that Government 
agencies must, at a minimum, make written inquiry to former employers, 
among other things, when seeking to hire an individual. Section 8 of 
this Order specifically details the type of information these written 
inquiries are designed to obtain, all of which is aimed toward 
determining the individual's suitability for Federal employment. 

(3)' DOJ Order 2600. 3A, "Requirements for Safeguarding 
Classified Information and Materials Released to Industry in 
Connection With Contracts or Grants," and the Department of Defense 
(DOD) Industrial Security Manual (Section III, paragraph 27), both of 
which govern the FBI's relationship with private industry, require a 
similar written inquiry to former employers, as specified above, when 
attempting to convert a former Government clearance. 

(4) In order for the FBI, as a current or former . 
employer, to conform to the requirements in EO 10450, DOJ Order * 
2600..3A, and DOD Industrial Security Manual, | SCU j personnel will review 
all pertinent files concerning the employee, specifically to include 
personnel and Administrative Inquiry files, and furnish. the requester 
any information deemed pertinent (to include derogatory information) '.,'■ 
to assist in the proper adjudication of the clearance matter. 
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26-12 SPECIAL CONTROL MARKINGS FOR SENSITIVE INTELLIGENCE 

SOURCES AND METHODS AND FOR FOREIGN INTELLIGENCE MATERIAL 
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26-12'. 1 Warning Notice - Sensitive Intelligence Sources and 
Methods Involved (WNINTEL) , . ' 

(1) Iii addition to instructions relating to dissemination 
of classified material set forth in the National Security Council 
Directive of May 17, 1972 (classified information or material ' 
originated in one department shall not be disseminated outside any 
_pj:her__department to which it has been made available without the 



consent of the originating department - known as the "third agency 
rule"), the Directive also requires that all information and material 
relating to sensitive intelligence sources and methods be prominently 
marked "WARNING NOTICE-SENSITIVE INTELLIGENCE SOURCES AND METHODS 
INVOLVED" (WNINTEL). The Directive instructs that material so marked 
may not be disseminated in any manner outside authorized channels 
without permission of the originating department and an assessment by 
the senior intelligence officer in the disseminating department of the 
potential risk to the national security and to the intelligence 
sources and methods involved. 
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(3) For FBI purposes, the marking "WNINTEL" will be 
utilized only in connection with Sensitive Compartmented Information 
(SCI) or uniquely sensitive information. 
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EFFECTIVE: 02/12/92 
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26-12.2 



Foreign Intelligence Material 



In addition to level of classification markings ("Top 
Secret," "Secret," and "Confidential") and WNINTEL markings, the 
following additional markings may be used on foreign intelligence, 
when, in the opinion of the originating organization, extraordinary 
circumstances require further restrictio ns on d isseminat ion of fore ign 
intelligence: 

(1) DISSEMINATION AND EXTRACTION OF INFORMATION 
CONTROLLED BY ORIGINATOR (ORCON) - May not be disseminated outside of 
the Headquarters of the receiving agency in any form, even extracted 
or paraphrased, without permission of originator. 

(2) NFIB DEPARTMENTS ONLY (NFIBONLY) - May not be 
disseminated to an organization not represented on the National 
Foreign Intelligence Board without permission of the originator. 
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(3) NOT RELEASABLE TO CONTRACTORS OR 
CONTRACTOR/CONSULTANTS | (NOCONTRACT) | - May not be disseminated to 
contractors or contractor-consultants without permission of 
originator. 



(A) CAUTION - PROPRIETARY INFORMATION INVOLVED (PROPIN) - 
Recipients shall take every precaution to ensure the information is 
not used to the detriment of the source. 






(5) NOT RELEASABLE TO FOREIGN NATIONALS (N0F0RN) - May 
not be released in any form to foreign governments, foreign nationals 
or non-U. S. citizens without permission of the originator. 



EFFECTIVE: 02/12/92 
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26-13- 



UNAUTHORIZED DISCLOSURE OF CLASSIFIED INFORMATION 



Department of Justice and FBI regulations provide for 
disciplinary action for employees who violate provisions of Executive 
Order 12356 and stringent administrative action may be taken against 
any employee determined to have been knowingly responsible for 
unauthorized disclosure of classified national security material. 
Whenever a violation of criminal statutes may be involved, prosecution 
may also be instituted. (See MIOG, Part II, Section 
26-4.1.) TheJNational Foreign Intelligence Program Manual 
(NFIPM), Appendix, 4-1. 1, |states in part that anybne who willfully 

^e^ln^ers_o^,_yir^gh_gr^ss_negligence ) loses any defense inform ation 

is liable to $10,000 fine or imprisonment for not more than ten years 
or both. ' 
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EFFECTIVE: 02/14/97 



26-13.1 



Loss or Possible Compromise of Classified Information! (See 
MIOG, Part I, 261-2(3) (b), II, 26-13.2, 26-13.3 (4); MAOP, 
Part II, 2-4.3.8(1) (a), 6-7.5 (2) (h) .3; FCIM, Part I, 
65-8.) 




Any person who has knowledge of the loss or possible 
compromise of classified information shall immediately report the 
circumstances to FBIHQ, Attention: | Security Programs Manager 
(SPM),|and the field off ice | Security Countermeasures Program Manager. 
When appropriate, the SPM will coordinate with the relevant 
substantive FCI entities within the National, Security Division to 
ensure compliance with the instructions set forth in the FCIM, Part I, 
Section 65, "Espionage," Section 65-3, "FBIHQ Policy." In addition, 
the SPM will notify the|agency that originated the information of the 
loss or possible compromise. so that a damage assessment may be 
conducted and appropriate measures taken to negate or minimize any 
adverse effect of the compromise pursuant to guidelines set forth in 
Title 32, Code of Federal Regulations (CFR) , Part 2001, Section 
2001.47, as follows:. 

"(a) Initiation of Damage Assessments. An agency 
head shall initiate a damage assessment whenever there has been a 
compromise of classified information originated by that agency that, 
in his or her judgment, can reasonably be expected to cause damage to 
the national security. Compromises may occur through espionage, 
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unauthorized disclosures to the press or other members of the public,' 
unauthorized sales, publication of books and treatises, the known loss 
of classified information or equipment to foreign powers, or through 
various other circumstances. 

"(b) Content of Damage Assessments. At a minimum, 
damage assessments shall be in writing and contain the following: 

"(1) Identification of the source, date, and 
circumstances of the compromise. 

__, "( 2 ) Classification of the s pecif ic 



information lost. 



lost. 



"(3) A description of the specific information 



"(4) An analysis and statement of the known or 
probable damage to the national security that has resulted or may 
result. 

"(5) An assessment of the possible advantage 
to foreign powers resulting from the compromise. 

"(6) An assessment of whether (i) the 
classification of the information involved should be continued without 
change; (ii) the specific information, or parts thereof, shall be 
modified to minimize or nullify the effects of the reported compromise 
and the classification retained; (iii) downgrading, declassification, 
or upgrading is warranted, and if so, confirmation of prompt 
notification to holders of any change. 

"(7) An assessment of whether countermeasures 
are appropriate and feasible to negate or minimize the effect of the 
compromise. 

"(8) An assessment of other appropriate 
corrective, administrative, disciplinary or legal actions. 

"(c) System of Control of Damage Assessments. Each 
agency shall establish a system of control and internal procedures to 
ensure that damage assessments are performed in all cases described in 
paragraph (a) , and that records are maintained in a manner that 
facilitates their retrieval and use within the agency. 

"(d) Cases Involving More Than One Agency. 
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"(1) Whenever a compromise involves the, 
classified information or interests of more than one agency, each 
department or agency undertaking a damage assessment shall advise 
other agencies of the circumstances and findings that affect their 
information or interests. Whenever a damage assessment, incorporating 
the product of two or more agencies is needed, the affected agencies 
shall agree upon the assignment of responsibility for the assessment. 



(2) Whenever a compromise occurs within an 
agency that is not responsible for the damage assessment, that, agency 

shall„provide_all_ data.. pert inent_to_the_.compr.omise_to_the_agency_ „ 

responsible for conducting the assessment. 



"(3) Whenever a compromise of U.S. classified 
information is the result of actions taken by foreign nationals, by 
foreign government officials, or by U.S. nationals in the employ of 
international organizations, the agency performing the damage 
assessment shall ensure through appropriate intergovernmental liaison 
channels, that information pertinent to the assessment is obtained. 
Whenever more than one agency is responsible for the assessment, those 
agencies shall coordinate the request prior to transmittal through 
appropriate channels. 

"(A) Whenever an action is contemplated 
against any person believed responsible for the compromise of 
classified information, damage assessments shall be coordinated with 
appropriate agency legal counsel. Whenever a violation of criminal 
law appears to have occurred and a criminal prosecution is 
contemplated, the agency responsible for the damage assessment shall 
coordinate with the Department of Justice. 

"(5) The designated representative of the 
Director of Central Intelligence, or other appropriate officials with 
responsibility for the information involved, will be consulted 
whenever a compromise of Sensitive Compartmented Information (SCI) has 
occurred." 



EFFECTIVE: 03/15/94 
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A damage assessment must be conducted in accordance with 
MIOG, Part II, Section 26-13.1 for any classified file or serial 
missing for 30 days or more. This damage assessment must be reported. 
as outlined in the Manual of Administrative Operations and Procedures, 
Part II, Section 2-4.3.8(1). 




EFFECTIVE: 08/27/90 
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1 26-13.3 Cases Involving Loss or Unauthorized Disclosure of 
Sensitive Compartment ed Information (SCI) 

(1) The Director of Central Intelligence Directive (DCID) 
No. 1/19 sets forth the security policy for SCI. Compliance with this 
policy is mandatory for all Intelligence Community agencies that 
■operate SCI programs. 

( (2) DCID No. 1/19 refers to the Senior Official of the 

Intelligence Community (SOIC) or his/her designee as the person 
responsible for ensuring DCID requirements are met. The SOIC has the 
responsibility for the granting, denial, and revocation of access to 
SCI. r 

(3) The Director, FBI, as the SOIC for the FBI, has 
delegated the authority to protect SCI to the Security Programs 
Manager (SPM) , who is responsible for ensuring compliance with DCID 
requirements. 

(4) Whenever there is a suspicion that there has been a - 
serious compromise or unauthorized disclosure of SCI, an investigation 
will be conducted to determine if there is a reasonable likelihood 
that a compromise of SCI may have occurred, the identity of the 
person(s) responsible for the unauthorized disclosure, and the need 
for remedial procedures to preclude a recurrence. (See also 26-13.1.) 

(5) If a compromise is determined to have occurred, the ' 
SPM will report the incident to the designated representative of the 
DCI. An investigation is to be conducted to identify full details of 
the violation/compromise, and to determine what specific information 
was involved, what damage resulted, and whether culpability was 
involved in the incident. 

(6) If a case involves an inadvertent disclosure, the SPM 
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will exercise his/her judgment as to whether the interests of SCI 
security are served by seeking written agreements from unindoctrinated 
•persons to whom SCI has been inadvertently disclosed. If the judgment 
is that those interests are so served, the person (s) involved signs 
the Inadvertent Disclosure Statement FD-722 (see 26-4.1), and the SPM 
has reason to believe that the person (s) will maintain absolute 
secrecy concerning the SCI involved, the report of investigation may 
conclude that no compromise occurred. 

(7) Summaries of investigations and of related actions 
shall be provided to the DCI through the DCI ' s Unauthorized 
.Dis.clflfl.uxes_Analysi.s_CenJtejr_by_the_SPM: ._ ________ 



(a) when investigations show that the SCI was 
inadvertently disclosed to foreign nationals or deliberately disclosed 
to unauthorized persons; or 

(b) when cases under investigation involve damage 
deemed significant by the SPM — espionage, flagrant dereliction of 
security duties, or serious inadequacy of security policies or 
procedures. 

(8) The SPM will ensure that corrective action is taken 
in all cases of actual security violations and compromises.! 



1- ■i-?l*. 
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EFFECTIVE: 08/27/90 



26-14 CLEARANCES OF PERSONNEL HANDLING SENSITIVE COMPARTMENTED 
INFORMATION (SCI) MATERIAL 

(1) All FBI employees requiring access to SCI material 
must be cleared prior to being granted access to that level of 
material. This includes couriers and individuals who type or otherwise 
process SCI material. 

(2) All teletype operators, including alternates, must be 
cleared for access to "SI" material in order to facilitate 
round-the-clock transmission of "SI" information. 




EFFECTIVE: 08/27/90 
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26-15 DESTRUCTION OF CLASSIFIED MATERIAL I (See MIOG, Part II, 
35-9.4.14.) | . 

(1) When no longer needed, classified material shall be 
destroyed as soon as practicable by shredding, burning, . pulverizing, 
pulping, melting, chemical decomposition, or other mutilation method 
sufficient to preclude any recognition or. reconstruction of the. 
information. (See MAOP, Part II, 2-1.3.) 



■ > *. \*,. 



(2) The destruction of Top Secret and Sensitive 
Com partmented Information (SCI) must be witnesse d and r ecorded b y two 
employees with security clearances commensurate with the 
classification of the material being destroyed. This information is 
to be recorded on the FD-501 and shall include the names of the 
employees, the reason for destruction, and the date, location and 
method of destruction. 



% 







EFFECTIVE: 07/26/95 
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SECTION 28. SEARCH AND SEIZURE OF DOCUMENTARY MATERIALS 



ATTORNEY GENERAL'S GUIDELINES ON METHODS OF OBTAINING 
DOCUMENTARY MATERIALS HELD BY THIRD PARTIES 
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Pursuant to Title II, Privacy Protection Act of 1980 (Pub. 
L. 96-440, Sec. 201 et seq.; 42 U.S.C. 2000aa-ll, et seq.), the Attorney 
_Gene r a l__has__i ssued the foll owin g gu idelines in connection with the 
obtaining by Federal officers of documentary evidence in possession of 
third parties: 
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"Section 59.1 Introduction. 

"(a) A search for documentary materials necessarily involves 
intrusions into personal privacy. First, the privacy of a person's home 
or office may be breached. Second, the execution of such a search may 
require examination of private papers within the scope of the search 
warrant, but not themselves subject to seizure. In addition, where such 
a search involves intrusions into professional, confidential 
relationships, the privacy interests of other persons are also 
implicated. 

"(b) It is the responsibility of federal officers and 
employees to recognize the importance of these personal privacy 
interests, and to protect against unnecessary intrusions. Generally, 
when documentary materials are held by a disinterested third party, a 
subpoena, administrative summons, or governmental request will be an 
effective alternative to the use of a search warrant and will be 
considerably less intrusive. The purpose of the guidelines set forth in 
this part is to assure that federal officers and employees do not use 
search and seizure .to obtain documentary materials in the possession of 
disinterested third parties unless reliance on alternative means would 
substantially jeopardize their availability (e.g., by creating a risk of 
destruction, etc.) or usefulness (e.g., by detrimentally delaying the 
investigation, destroying a chain of custody, etc.). Therefore, the . 
guidelines in this part establish certain criteria and procedural 
requirements which must be met before a search warrant may be used to /■• 
obtain documentary materials held by disinterested third parties. The 
guidelines in this part are not intended to inhibit the use of less 
intrusive means of obtaining documentary materials such as the use of a 
subpoena, summons, or formal or informal request. 
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"Section 59.2 Definitions. • ,ir" 

"As used in this part 

"(a) The term "attorney for the government' shall have the * 
same meaning as is given that term in Rule 54(c) of the Federal Rules of 
Criminal Procedure; 



, ?■:: •&?& 
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"(b) The term 'disinterested third party' means a person or 
organization not reasonably believed to be 




'(1) A suspect in the criminal offense to which the 



materials sought under these guidelines relate; or ~ — 

"(2) Related by blood or marriage to such a suspect; 

"(c) The term 'documentary materials ' means any materials 
upon which information is recorded, and includes, but is not limited to, 
written or printed materials, photographs, films or negatives, audio or 
video tapes, or materials upon which information is electronically or 
magnetically recorded, but does not include materials which constitute 
contraband, the fruits or instrumentalities of a crime, or things 
otherwise criminally possessed; 
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"(d) The term 'law enforcement officer' shall have the same 
meaning as the term 'federal law enforcement officer' as defined in Rule 
41(h) of the Federal Rules of Criminal Procedure; and 

"(e) The term 'supervisory official of the Department of 
Justice 1 means the supervising attorney for the section, office, or 
branch within the Department of Justice which is responsible for the 
investigation or prosecution of the offense at issue, or any of his - 
superiors. 

"Section 59.3 Applicability. 

"(a) The guidelines set forth in this part apply, pursuant 
to section 201 of the Privacy Protection Act of 1980 (Sec. 201, Pub. L. 
96-440, 94 Stat. 1879, (42 U.S.C. 2000aa-ll)), to the procedures used by 
any federal officer or employee, in connection with the investigation or 
prosecution of a criminal offense, to obtain documentary materials in the 
private possession of a disinterested third party. 

"(b) The guidelines set forth in this part do not apply to: 

"(1) Audits, examinations, or regulatory, compliance, 
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"(c) The use of search and seizure to obtain documentary 
materials which are believed to be possessed for the purpose of 
disseminating to the public a book, newspaper, broadcast, or other form 
of public communication is subject to Title I of the Privacy Protection 
Act of 1980 (Sec. 101, et seq. , Pub. L. 96-440, 94 Stat. 1879 (42 U.S.C. 
2000aa, et seq.)), which strictly prohibits the use of search and seizure 
to obtain such materials except under specified circumstances. 

"(d) These guidelines are not intended to supersede any 
other statutory, regulatory, or policy limitations on access to, or the 
use or disclosure of particular types of documentary, materials, 
including, but not limited to, the provisions of the Right to Financial 
Privacy Act of 1978 (12 U.S.C. 3401, et seq.), the Drug Abuse Office and 
Treatment Act of 1972, as amended (21 U.S.C. 1101, et seq.), and the 
Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and 
Rehabilitation Act of 1970, as amended (42 U.S.C. 4541, et seq.). 

"Section 59.4 Procedures. 

"(a) Provisions governing the use of search warrants 
generally. 

"(1) A search warrant should not be used to obtain 
documentary materials believed to be in the private possession of a 
disinterested third party unless it appears that the use of a subpoena, 
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or administrative inspections or searches pursuant to federal statute or ' ;*"' 

the terms of a federal contract; . i> 

"(2) The conduct of foreign intelligence or v^ 

counterintelligence activities by a government authority pursuant to £.£; 

otherwise applicable law; , v|i 

"(3) The conduct, pursuant to otherwise applicable ,\. 

law, of searches and seizures at the borders of, or at international ' -^ 

points of entry into, the United States in order to enforce the customs ' "%?.' 

laws of the United States; :l: : 

"(4) Governmental access to documentary materials for ^; 

which valid consent has been obtained; or £4 

"(5) Methods of obtaining documentary materials whose '; 

location is known but which have been abandoned or which cannot be. "''.,. 

obtained through subpoena or request because they are in the possession -h- 

of a person whose identity is unknown and cannot with reasonable effort .-?.' 
be ascertained. 
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susOTons, request; or other less intrusive alternative means of obtaining 
the materials would substantially jeopardize the availability or. ., - v.. 
usefulness of the materials sought, and the application for the warrant. - 
has been authorized as provided in paragraph (a)(2) of this section. 

"(2) No federal officer or employee shall apply for 
a warrant to search for and seize documentary materials believed to be ; 
in the private possession of a disinterested third party unless the , 
application for the warrant has been authorized by an attorney for the 
government. Provided, however, that in an emergency situation in which 
the immediacy of the need to seize the materials does not permit an 
oppor tuni t v to secu ™ fh» authorization of an attorney for the — _______ 

"government, the application may be authorized by a supervisory law 
enforcement officer in the applicant's department or agency, if the 
appropriate United States Attorney (or where the case is not being 
handled by a United States Attorney's Office, the appropriate supervisory 
official of the Department of Justice) is notified of the authorization 
and the basis for justifying such authorization under this part within 
24 hours of the authorization. 

"(b) Provisions governing the use of search warrants which 
may intrude upon professional, confidential relationships. 

"(1) A search warrant should not be used to obtain 
documentary materials believed to be in the private possession of a 
disinterested third party physician, lawyer, or clergyman, under 
circumstances in which the materials sought, or other materials likely 
to be reviewed during the execution of the warrant, contain confidential 
information on patients, clients, or parishioners which was furnished or 
developed for the purposes of professional counseling or treatment, 
unless 

"(i) It appears that the use of a subpoena, summons, ; 
request or other less intrusive alternative means of obtaining the ._..; 
materials would substantially jeopardize the availability or usefulness- 
of the materials sought; ' 

"(it) Access to the documentary materials appears to 
be of substantial importance to the investigation or prosecution for 
which they are sought; and-. ,...-'". 

. "(iii) The application for the warrant has been - " ; . 
approved as provided in paragraph (b)(2) of this section. 

"(2) No federal officer or employee shall apply for 
a warrant to search for and seize documentary materials believed to be 
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in the private possession of a disinterested third party physician", ■' 
lawyer, or clergyman under the circumstances described in paragraph 
(b)(1) of this section, unless, upon the recommendation of the United 
States Attorney (or where a case is not being handled by a United Stares 
Attorney's Office, upon the recommendation of the appropriate supervisory i§£ 

official of the Department of Justice), an appropriate Deputy Assistant %l 

Attorney General has authorized the application for the warrant. ! 
Provided, however, that in an emergency situation in which the immediacy' 
of the need to seize the materials does not permit an opportunity to 
secure the authorization of a Deputy Assistant Attorney General, the 

application may be authorized by the United States Attorney (or where the l «|| 

_case_is_not_b,einB_handle,d_by_a_United_States_Attorney's Office, by the 
appropriate supervisory official of the Department of Justice) if an 

appropriate Deputy Assistant Attorney General is notified of the If 

authorization and the basis for justifying such authorization under this 
part within 72 hours of the authorization. 

"(3) Whenever possible, a request for authorization -Ji 

by an appropriate Deputy Assistant Attorney General of a search warrant :^ 

application pursuant to paragraph (b)(2) of this section shall be made .''.■?' 

in writing and shall include: l^W 
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"(i) The application for the warrant; and ''". 

"(ii) A brief description of the facts and . .cj|; 

circumstances advanced as the basis for recommending authorization of the -jfL 

application under this part. : *4:10 

■■'"%£&: 

"If a request for authorization of the '^%- 

application is made orally or if, in an emergency situation, the " * 
application is authorized by the United States Attorney or a supervisory 

official of the Department of Justice as provided in paragraph (b) (2) of j%& 

this section, a written record of the request including the materials '*§§■ 

specified in paragraphs (b) (3) (i) and (ii) of this section shall be V^tl 

transmitted to an appropriate Deputy Assistant Attorney General within ' ^Hl| : 
7 days. The Deputy Assistant Attorneys General shall keep a record of 
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the disposition of all requests for authorizations of search warrant '~j&f 

applications made under paragraph (b) of this section. . Sf% 
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'(4) A search warrant authorized under paragraph 
(b) (2) of this section shall be executed in such a manner as to minimize, 
to the greatest extent practicable, scrutiny of confidential materials. vf| 

"(5) Although it is impossible to define the full v. 

range of additional doctor-like therapeutic relationships which involve 
the furnishing or development of private information, the United States 
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Attorney (or where a case is not being handled by a United States . -;" : ; ' 
Attorney's Office, the appropriate supervisory official of the Department 
of Justice) should determine whether a search for documentary materials^, 
held by other disinterested third party professionals involved in suchv/-- 
relationships (e.g., psychologists or psychiatric social workers or 
nurses) would implicate the special privacy concerns which are a dressed 
in paragraph (b) of this section. If the United States Attorney (or 
other supervisory official of the Department of Justice) determines that 
such a search would require review of extremely confidential information 
furnished or developed for the purposes of professional counseling or 
treatment, the provisions of this subsection should be applied. 

Otherwise, a t a minim um t _the_ req uirement s of parag «p|^(a)_of_ thjj — 

section must be met. 

"(c) Considerations bearing on choice of methods. 

"In determining whether, as an alternative to the use 
of a search warrant, the use of a subpoena or other less intrusive means 
of obtaining documentary materials would substantially jeopardize the 
availability or usefulness of the materials sought, the following 
factors, among others, should be considered: 

"(1) Whether it appears that the use of a subpoena or 
other alternative which gives advance notice of the government !s interest 
in obtaining the materials would be likely to result in the destruction, 
alteration, concealment, or transfer of the materials sought; 
considerations, among others, bearing on this issue may include: 
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'(i) Whether a suspect has access to the materials 



sought; 






"(ii) Whether there is a close relationship of 
friendship, loyalty, or sympathy between the possessor of the materials* 
and a suspect; ,„ 

"(iii) Whether the possessor of the materials is under 
the domination or control of a suspect; .; 

' "(iv) Whether the possessor of the materials has an 
interest in preventing the disclosure of the materials to the government; 

• , . " ' - V-" <*■* ' '"'" 

"(v) Whether the possessor's willingness to comply - 
with a subpoena or request by the government would be likely to subject 
him to intimidation or threats of reprisal; 

"(vi) Whether the possessor of the materials has 
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previously acted to obstruct a criminal investigation or judicial -^ 
proceeding or refused to comply with or acted in defiance of court 
orders; or\ ' ^ . ■ 

"(vii) Whether the possessor has expressed an intent 
to destroy, conceal, alter, or transfer the materials; 

"(2) The immediacy of the government's need to obtain 
the materials; considerations, among others, bearing of this issue may 
include: 



"(i ) Whether the immediate se i zure of the materials 



is necessary to prevent injury to persons or property; 

"(ii) Whether the prompt seizure of the materials is 
necessary to preserve their evidentiary value; 

"(iii) Whether delay in obtaining the materials would 
significantly jeopardize an ongoing investigation or prosecution; or 

"(iv) Whether a legally enforceable form of process, 
other than a search warrant, is reasonably available as a means of 
obtaining the materials. The fact that the disinterested third party 
possessing the materials may have grounds to challenge a subpoena or 
other legal process is not in itself a legitimate basis for the use of 
a search warrant. 

"Section 59.5 Functions and Authorities of the Deputy 
Assistant Attorneys General. 

"The functions and authorities of the Deputy Assistant 
Attorneys General set out in this part may at any time be exercised by 
an Assistant Attorney General, the Associate Attorney General, the Deputy 
Attorney General, or the Attorney General. 

"Section 59.6 Sanctions. 

"(a) Any federal officer or employee violating the . 
guidelines set forth in this part shall be subject to appropriate 
disciplinary action by the agency or department by which he is employed. . 

"(b) Pursuant to section 202 of the Privacy Protection Act 
of 1980 (Sec. 202, Pub. L. 96-440, 94 Stat. 1879 (42 U.S.C. 2000aa-12)), 
an issue relating to the compliance, or the failure to comply, with the 
guidelines set forth in this part may not be litigated, and a court may 
not entertain such an issue as the basis for the suppression or exclusion 
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29-1 



DEFINITION 



'^ 




m 




The TRAC is responsible for conducting research on terrorism, 
analyzing the data received, and making assessments of the potential 
terrorist threats to the United States. 



EFFECTIVE: 02/23/84 



29-2 



SERVICES 



(1) To computerize data on all domestic and international 
terrorist groups which pose a threat to the United States. 

(2) To conduct research on terrorist groups, analyze data, 
and produce assessments of the potential dangers posed by those groups 
to the United States. 

(3) To record, maintain, analyze, and publish statistical 
information concerning terrorism and terrorist incidents in the United 
States and the accomplishments of the FBI's counterterrorism efforts. 

(4) To prepare the terrorism program budget submissions. 

(5) To maintain a terrorist reference library consisting of 
books, periodicals, newspapers, NEXIS (a computer assisted public 
information source), slides and audio video cassettes on various - 
terrorist-related incidents, and a vertical file which contains indexed 
research material consisting of papers produced by TRAC personnel and 
papers which are primary and secondary sources of information in research 
as well as papers ephemeral in nature usually of temporary interest. 

(6) To administer a terrorism training program. 



EFFECTIVE: 02/23/84 
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SECTION 30. (CRISIS MANAGEMENT PROGRAM I 



I 30-1 CRISIS MANAGEMENT PROGRAM | (See MIOG, Part I, 261-2(6), 
I NFIP Manual, Part I, 8-1.1.) j 

(1) Crisis management is the process of identifying, 
acquiring, and planning the use of resources needed to anticipate, 

_ prevent , and /or resolve a crisis. The program, as it currently exists 
in the Bureau, encompasses two other major programs: crisis (hostage) 
negotiation and special weapons and tactics (SWAT). However, these 
are not the only resources involved in crisis management. 

(2) The components (resources) that may be included on 
any crisis management team are: 

(a) Managerial 

(b) Negotiators 

(c) Tactical (SWAT/Hostage Rescue Team (HRT)) 

(d) Technical 

(e) Investigative 

(f) Support 

(g) Special Operations Groups (SOG) 
(h) Legal 

(i) Media Representative 

(3) Crisis management involves planning the use of these 
components and coordinating their actions at the crisis scene. 

EFFECTIVE: 02/27/96 
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30-1.1 Objectives 

(1) To preserve life. " t -''.\ 

(2) To enforce the laws over which the FBI has v£ 
jurisdiction. •;" 

In keeping with these objectives, the guiding principle in 

nego ti at ion/SWAT employment, as in all actions in a given crisis, 

should be to minimize the risks to all persons involved: hostages, '' " 

bystanders, subjects, and law enforcement officers. 
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30-1.2 Control of a Crisis Management Team (CMT) 

■ (1) Operational and administrative control of crisis 
management components lies with the SAC within the respective field 
office, except in certain unusual or major cases such as those 
involving dignitaries, diplomats, a large hostage population, or cases 
involving national or international impact, in which direct 
operational control may be assumed by the Assistant Director (AD), 
Criminal Investigative Division (CID) , ,or AD, Intelligence Division 
(INTO), FBIHQ, or their designated representative. The SAC of the 
office employing crisis management components must personally assume 
direct management responsibility and control of those components. 

(2) The SAC or his/her designated representative must 
assume the responsibility of on-scene commander (OSC) during a crisis 
incident. It is the duty of the SAC/OSC to determine the overall 
strategy for responding to and/or resolving a crisis incident. The 
crisis management component leaders will then devise specific 
tactics/procedures to support the SAC/OSC s strategy. These 
tactics/procedures are all subject to the approval of the SAC/OSC. 

(3) The Crisis Management, Negotiation, and SWAT Programs 
are coordinated at the FBIHQ level by a program manager working in the 
Special Operations and Research Unit (SOARU) in the Training Division. 
Training Division, through the SOARU, is responsible for crisis 
management, negotiation, and SWAT training; doctrinal development; 
research and evaluation; advisory services; certain logistic support 
to the field; and operational support to FBIHQ and the field. 
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EFFECTIVE: 01/18/91 



30-1.3 Crisis Management Plans 

(1) The preparation of plans to anticipate and respond to. 
specific crisis situations is imperative. 

(2) The following procedures should be used when 
preparing such plans: 



(a) Identify potential crisis situations. 

(b) Prioritize potential crisis situations. 

(c) Determine what is expected of the Bureau during 
the crisis (objectives). 

(d) Make provisions to acquire the resources needed 
to accomplish your objectives. 

(e) Identify sources of intelligence: 

1. Human — collect background/descriptive 
information on subjects, employees, occupants, and others having 
access to crisis site. 

2. Physical — conduct a thorough site survey of 
the crisis site. 

(f) Develop strategies and tactics — developing the 
overall strategy for a particular crisis situation is a command 
function. Once the strategy is determined, the other components of 
the CMT develop specific tactics to support the overall strategy of 
the OSC. 

(g) Determine command/control/communications 
requirements. 

1. If it is a joint operation, determine who 
will be the lead agency. Once this is decided, designate a chain of 
command. 

2. Select location for a command post. 
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3. Design a communications format. ..^ 

(h) Determine logistics required to support the 
overall response to the crisis. 

/ " !;%*?. 

. (i) Establish liaison and coordination with if:. 

contributing agencies and services. ?v 

(j) Commit plan to paper. 

(k) Test the plan and modify accordingly. 



&££■ 






(1) Disseminate the plan to appropriate personnel. 
EFFECTIVE: 01/18/91 

30-1.4 Decision Making 

Decisions must be made while working within the context of 
the crisis management plan to assure an acceptable solution. When in 
a decision-making mode, it is helpful to include others in the 
decision-making process and weigh decisions against preestablished 
criteria. 

(1) Action criteria should consider: 

(a) Necessity — is the contemplated action necessary 
at this time within the context of the crisis event? 

(b) Risk effectiveness — is the contemplated action 
warranted because it will reduce risk? Or will it increase risk? .'$■ 

(c) Acceptability — is the contemplated action c£ 
legally and ethically acceptable? '$$£'■ 

(2) Having clearly defined objectives when planning for a " u f. 
particular crisis (and being able to prioritize them) will facilitate r . 
good decision making. • ";F;" 
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30-1.5 



Command Post (CP) Procedures 
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V:l 



(1) Some type of CP is necessary to coordinate the . 
actions of multiple units, especially when they are engaged in 
multiple activities, or when the number of individuals involved in a. 
crisis situation exceeds the span of control of the OSC. 

(2) Prior to setting up the-CP, the following steps 
should be taken: 

(a) Establish a command structure to include all 
crisis management components being used. This chain of command must 



be communicated and formally posted. 

(b) Assign responsibilities to the components of 
the command structure (mission). 

(c) The leader of each component must be delegated 
the authority to successfully accomplish that component's mission. 

(d) Design an organizational format for the CP. 

(e) Develop a standing operating procedure (SOP) for 
the CP. This SOP should outline a procedure for the gathering and 
processing of intelligence. All components represented in the CP must 
have a system that enables them to receive, analyze, file, and 
retrieve intelligence. The SOP should also outline procedures for 
communicating this intelligence to the on-scene commander and other 
components in the CP. 

> ' ' ' 

(f) When possible, use an advisory staff, in the CP. 
The SAC will designate an individual to act as a representative of 
each component of the CHT. This individual should preferably be a 
supervisor who is familiar with the capabilities and limitations of 
that particular component. This group of supervisors/Special Agents 
will be called advisors. (e.g. , SWAT advisor, negotiation advisor) and 
will form the SAC's advisory staff. In crisis situations where the 
SAC and his/her CP are in close proximity to the actual component 
leaders, the use of an advisory staff would not be absolutely 
necessary. However, in crisis situations where the SAC and his/her CP 
are not in close proximity to the component leaders, there are certain 
advantages to using the advisory staff: 

1. It enables the component leader to be with, 
and function with, his/her team, which is the best place for the team 
leader to be. 
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•"■ ' 2. It provides the SAC with a knowledgeable . 

staff that is always in the CP and prepared to answer any questions 
regarding a particular component. 

.' r 3. It provides the SAC with an individual in 

the CP that will receive, analyze, file, and retrieve intelligence 
from a particular component. 
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(g) In addition to an advisor for each component of 
the CMT, the SAC will also designate a crisis management advisor in 
_t_h_e_CP ,__Thi s_indi vidual_wi 1 l._ens.ure_th.e_CF_i s_operat ing__in_accordance^ 
with the SAC's CP< procedures. The crisis management advisor can 
identify problem areas and correct them before any serious problems 
occur. This advisor will also ensure all components are communicating 
and coordinating all their actions at the crisis site. 
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30-1.6 Field Office Response to Crisis Situations (See MIOG, Part 
I, 252-1.7.) 



^v 



(1) The crisis management assets of most field offices 
may not be capable of adequately handling a major or protracted crisis 
situation without additional assets. When it becomes apparent a 
crisis situation will continue for more than 24 hours, the SAC may 
contact surrounding field offices for additional resources. 

(2) The SOARU has divided the 56 field offices into eight 
districts and 16 regions. Each district contains one to three 
regions, and each region contains from two to five field offices. Any 
field office that is faced with a crisis situation demanding a 
response exceeding its capability can call upon its region for 
additional resources. The districts and regions are structured as 
follows: (See 30-2.2(2) and 30-3.2(3) .) 



^ ; 
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Region 1 



FIELD SWAT DISTRICT/REGION ASSIGNMENTS 
DISTRICT 1 
Region 2 



Region 3 
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Region 4 



.DISTRICT 2 
Region 5 \£ 







Region 6 





DISTRICT 3 



Region 7 





Region 9 



DISTRICT 4 
Region 10 



Region 11 




Region 8 



DISTRICT 5 

Region 12 



DISTRICT 6 
Region 13 



DISTRICT .7 



Region 14 



Region 15 



DISTRICT 8 



Region 16 
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* Denotes the |9 (Enhanced District Teams 
( ) Denotes SWAT Complement w/56 Field Offices 



TOTAL 







(3) In confrontations necessitating employment of force 
involving an extraordinary degree of risk and which, in the judgment 
of the SAC, exceed FBI SWAT capability, the AD, CID, or AD, National 
Security Division, or their representative, should be advised in the 
event s peciali zed tactical intervention may be req ues ted. The FBI 



entity charged with responding to these incidents is the HRT. The HRT 
may be requested through CID, Violent Crimes and Major Offenders 
Section, FBIHQ. 
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EFFECTIVE: 08/29/94 

| 30-1.7 Training 

| (1) At Quantico: 

(a) Four days of crisis management training is 
conducted during Executive Development Institute (EDI) training 
sessions. 

(b) One day of crisis management training is 
conducted during FBI Supervisors' Management Seminars. 

| (2) In the field: 

(a) Each field office must conduct at least one 
training session per year that enables the components of the crisis 
management team to interact, in a realistic crisis scenario. This 
training session should include a command post exercise (CPX) and 
field training exercise (FTX) . 

(b) The SAC and his/her management staff must be 
directly involved in this training session. • ""• 

(c) The negotiation, and SWAT components are mandated 
to participate in one regional training session each year. The host 
field office of the regional training session should conduct their 



Kg. 



■V.i- 



■jh 






Sensitive 
PRINTED: 02/18/98 







Sensitive 



Manual of Investigative Operations and Guidelines 
Part II 



PAGE 30 - 



■ "* w 

•• • .'V!- 

'- *& 



crisis management training during this regional training session (see 
(a) above) . 

(d) Training Division recommends that all crisis 
management components interact and train together whenever possible. 



EFFECTIVE: 01/18/91 



30-1.8 



Reporting Procedures 



(1) Each field office will submit semiannual reports on 
the utilization of their crisis management components, furnishing the 
following data: 

(a) Date of use. 



(b) Bureau and field office file number, title, and 
character of case. 

(c) A brief account of the activity, specifically 
outlining the role played by each component of the CMT. 

(d) The negotiation and SWAT components will also 
include enclosures to this report, detailing specific information 
regarding these components. Specifics are enumerated in the Crisis 
Negotiation and SWAT Program sections that follow. 

(2) Reports are due by the 15th day of April and October, 
for the previous six months. They must be transmitted by cover airtel 
to the. Director, FBI, Attention: Training Division, Special 
Operations and Research Unit. 




EFFECTIVE: 01/18/91 
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30-2 



CRISIS (HOSTAGE) NEGOTIATION PROGRAM 



(1) Crisis negotiation is the process of using specific 
techniques (relying heavily on verbal communications) to bring about a 
desired behavioral change on the part of an individual who may pose a 
threat to himself/herself or others, and to offer an alternative to 
(or support of) tactical intervention in raids, arrests, and rescues. 

(2) Specially trained and equipped Agent volunteers will 
function as part of a field office crisis management team. This 
crisis negotiation team can greatly reduce the risks associated with 
handling hosta ge, kidna p , bar rica de, and/or suicide situations and 



increase the options available to the SAC in dealing with such events. 
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30-2.1 




Control of Negotiators 



(1) Operational and administrative control of negotiators 
is the same as mentioned in 30-1.2(1). 

(2) The S0ARU also manages the FBI's Critical Incident 
Negotiation Team (CINT) . The CINT is comprised of the FBI's most 
experienced negotiators who have a specialized investigative and/or 
foreign language capability. CINT members are afforded advanced 
training in negotiation and terrorism to include nuclear, chemical, 
and biological negotiation considerations. This team is considered a 
national resource for the FBI and is deployed at the direction of 
FBIHQ through contact with the SOARU. 



m 
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30r2.2 



Organization 



(1) Each field office will have a crisis negotiation team 
with a minimum of three trained negotiators. The eight field offices 
that have the enhanced SWAT district teams will have a minimum of six 
trained negotiators. Larger^field offices or offices with distant 
resident agencies should have additional Agents trained as 
negotiators. The total number of negotiators in a field office should 
be based on the geographical area covered, the population density, and 
the potential for utilization. 
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(2) Any field office facing an event demanding a response 
exceeding its capability can call upon its region for negotiator, 
support.. The districts and regions are structured as indicated in the 
district chart at 30-1.6(2). 

(3) The configuration of the negotiation team within each 
field office is left to the discretion of the. SAC, but it must always 
have two negotiators per shift — a primary and a secondary negotiator. 
This team may be supported by additional negotiators as needed. 

(4) ^Cs„w>JJ__appoint_ajnegotiat_ijm^ 



EFFECTIVE: 01/18/91 



30-2.3 Utilization 



EFFECTIVE: 01/18/91 . „ 

30-2. A Qualifications for Negotiation Team Members 

(1) Agents assigned to negotiation teams in the field 
must have satisfactorily completed the two-week basic negotiation 
training course at the FBI Academy. 

(2) Negotiation candidates should be: 
(a) Volunteers. 
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with the responsibility of being familiar with team capability. The ->.£$ 

negotiation coordinator should be an individual who has served ;^>; 

satisfactorily as a team member and has a good working knowledge of ^ 

basic negotiation and tactical concepts. ..,ry|j 

(5) The negotiation coordinator should act as negotiation 
advisor and representative in the CP during operations. 






Negotiators will deploy with the field office SWAT team in ?;§g 

any situation posing a higher-than-normal risk factor in which the '1^ 

SWAT team could anticipate encountering a potential barricade, I'SK 

suicide, or hostage situation. Such deployments should be based on " 1$£ 
available intelligence concerning the subject, weapons, and location. 
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(b) In excellent physical condition. 



- (c) Emotionally capable of functioning in a 

prolonged high-stress situation. 

(d) An FBI Agent for at least three years. 

Experience as a police officer, military service, or having a 
behavioral science background is also desirable and could be 
considered an exception to item (2) (d) above. 
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EFFECTIVE: 01/18/91 



30-2.5 



Reporting 



As set forth in 30-1.8(1) (a)-(c) , each field office is 
required to submit semiannual crisis management reports. The 
following additional negotiation data is to be furnished as an 
enclosure in this designated format: 

I. New tactics, techniques, concepts of operations or 
equipment successfully employed in negotiation operations during the 
reporting period. , 

II. Problems encountered relative to negotiation operation 
during the reporting period. 

III. Team status: 

A. Specialized training needed by your office. 

B. Official Bureau name of each team member. 

C. The identity of the negotiation coordinator. 

D. Number of days devoted to team training this 
reporting period. 
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| 30-2.6 Training 

| (1) At Quant i co : 

(a) Basic negotiation training will consist of a two 
week course at the FBI Academy. 

(b) Specialized regional training courses will be 
held every year as required. 

(2) In the field: 



■' — ~ ~ "(a) Training will consist of a minimum of six days 
per year. The maximum is to be determined by the SAC and his/her 

special heeds. 

/-■ 

(b) Each field office negotiation team will 
participate in one regional training session per year where the host 
office conducts a CPX/FTX. The negotiation team will also participate 
in the one mandatory crisis management training session per. year in 
their respective field office. 

(c) The SAC must personally participate when his/her 
office is hosting a regional training session. This responsibility is 
not to be delegated. 

EFFECTIVE: 01/18/91 

30-2.7 Management of Negotiation Teams 

(1) To fully utilize the capabilities of the negotiation 
team, the command of the team must be delegated to the negotiation, 
coordinator by virtue of his/her training with the team and 
familiarity with the capabilities of the team. 

(2) The SAC or his/her designated representative must 
assume the responsibility of OSC during a crisis incident. It is the 
duty of the SAC/OSC to determine the overall strategy for responding 
to and/or resolving a crisis incident. The negotiation coordinator 
will then devise specific negotiation tactics/procedures to support 
the SAC/OSC's strategy. These negotiation tactics/procedures are all 
subject to the approval of the SAC/OSC. 

(3) Negotiation team deployment on a regional or district 
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basis, or when the HRT is operationally deployed, will be supported by 
the SAC from the host office, or his/her ASAC in the event he/she is 
not available. The SAC/OSC will promptly designate a senior 
negotiation coordinator as the overall negotiation commander and 
ensure that the chain of command is understood by all personnel 
present. 

EFFECTIVE: 01/18/91 



30-2.8 Joint Operations 
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(1) Many FBI operations involve close work with other law 
enforcement agencies, and this relationship may necessarily extend to 
hostage or barricade situations involving FBI and police negotiation 

teams. "~.' 

(2) Due to the wide divergence of training, procedures, 

and professional competency of police negotiation teams, the {■* 

integration of police and FBI negotiation teams in a given operation 

should be approached with caution from standpoints of effectiveness, 

safety, and legal liability. v. 

(3) In joint operations, it is imperative that unified .£$ 
negotiation teams be established at the outset with one person clearly ^ 
in charge of all negotiations, preferably the most experienced FBI \M 
negotiation team leader present. The arbitrary assumption of command ■*•;■ 
by the FBI, particularly if police units are first on the scene, as ^r 
they frequently are, could be a sensitive and provocative maneuver _■ 
requiring tact and diplomacy on the parts of the SAC and negotiation 

coordinator. . ' 

(4) The decision to engage in a Joint operation must be ;£ 
made by the SAC and should be based on the recommendations of the 

negotiation coordinator, his/her team, and all other factors bearing 

on mission safety and effectiveness. """ 

EFFECTIVE: 01/18/91 
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30-2.9 



Use of FBI Negotiators in Non-FBI Matters 



(1) |0ffice of the General Counsel (OGC)jhas reviewed the 
use of FBI Special Agent negotiators in non-Federal matters. |OGC| 
opined that FBI negotiators could actively participate in situations 
lacking clear Federal. jurisdiction where the Special Agent negotiator 
is either the first person on the scene or where there is no state or 
local negotiator available. 

(2) |OGC| further advised hostage situations, by their very 
nature, involve emergency circumstances that would justify an FBI 
resppnse_evenj^.ejnB_a_FjBdje^aJ^iipIatipnJ 

if an FBI negotiator was not actually doing the negotiating,, the FBI 
negotiator could still furnish advice or consultation on the scene as 
part of our training responsibilities under Title 28, Code of Federal 
Regulations, Section 0.85(e). 

(3) Title 42, USC, Section 3774(a) authorizes the 
Director of the FBI to assist in conducting training of state or local 
law enforcement entities and conveys .some Federal authority on which 
FBI negotiators can operate in non-Federal situations. 



■ ':■*% 
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(4) Two guidelines concerning the role of an FBI 
negotiator providing assistance to local authorities in a non-Federal 
offense must be adhered to: 

(a) The FBI negotiator mus£ remain under the control 
of his/her SAC as opposed to the local authorities. 

(b) FBI negotiators should be extricated from the 
actual negotiations, using their best professional judgment, once 
trained local officers arrive and are in a position to safely assume 
responsibility for the situation. 



EFFECTIVE: 09/09/94 
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| 1 30-3 SPECIAL WEAPONS AND TACTICS (SWAT) PROGRAM | 

I The SWAT Program is a concept based. on the premise that a 

select group of highly motivated and well-conditioned Agent 
volunteers, specially equipped and trained to function as a team, can 
greatly reduce the risks associated with handling unusually dangerous 
raids, arrests, and rescues, and increase the options available to the 
SAC in dealing with such events. 




EFFECT IVE :_0 1 /_1 8/9.1. 



| 30-3. 1 | Control of SWAT . 

Operational and administrative control of SWATJis the same 
as mentioned in 30-1. 2(1). | 



EFFECTIVE: 01/18/91 



| 30-3.2[ Organization 

(1) Each FBI f ield| of f ice|has a primary SWAT unit, the 
size of which varies from|office to of f ice, | depending upon 
geographical area covered, population density, and the potential for 
violent crime within FBI jurisdiction. (Additionally, the eight 
technically enhanced district teams are configured to provide 
technical and operational support to field offices within their 
geographic districts. | 

(2) The size of [office | primary units may be increased 
only by FBIHQ, based upon recommendations of the SAC, supported by 
well documented rationale. [Additional requests for manpower increases 
will not be approved by FBIHQ without identifying corresponding 
reductions elsewhere.] 

(3) Realizing that the relatively small teams in . 
most | offices | will not be sufficient to handle major or protracted 
problems, the field has been divided into | eight districts and 16 
regions. Each district contains one to three regions and each region 
contains from two to five offices. | Any | off ice | facing an event 
demanding a response exceeding its capability can call upon its region 
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for reinforcement, not only for SWAT personnel, but other crisis 
management assets. [Should an event exceed the capability of any 
.specific region or require specialized equipment not in the possess 
of that field office, an SAC may request assistance from his/her 
district team. Requests for regional or district support, however, 
should be kept to a minimum. When requested, this support may be f 
equipment only, equipment and a minimum number of operators, or tnor 
extensive reinforcement. The districts and regions are structured 
indicated in the district chart in 30-1.6(2), with the primary SWAT 
complement designated in parentheses. j 



ion 



or 

e 
as 







# 



. (4 ) Prima ry team members will be supported wjth_trjaining_ 

and equipment by the Training Division. Each SAC is authorized to 
develop and maintain reserve teams as needed,, but they must be 
supported by utilizing field resources. Reserve teams will 
participate in monthly field SWAT training at the discretion of the 
SAC. 

(5), The configuration of teams within each|off ice| is left 
to the discretion of the SAC, | except that all primary team members 
should be assigned to headquarters city. | 

(6) Each primary team within|an office must | be directed 
by a team leader selected by the SAC from the primary members. If |an 
officejhas more than one team, a senior team leader |must (be appointed 
among the primary team leaders to manage all SWAT teams within 
the|office.| 

(7) SACs [will [appoint a separate SWAT advisor, | preferably 
a Supervisory Special Agent | charged with the responsibility of being 
familiar with team capability and acting in the capacity of tactical 
advisor and SWAT representative in the command post during operations. 

(8) The SWAT advisor should be an individual who has 
|previouslyj served satisfactorily as a team member and has a good 

working knowledge of basic tactical concepts but is no longer a 
participant on a team. 
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||30-3.3| ' Utilization 

(1) A raid, arrest or other situation posing a higher- 
than-normal risk factor will necessitate the use of a SWAT unit for 
planning and execution whenever practicable to reduce the risk, to 
Agents, innocent persons, and subjects. 

(2) The determination as to whether a given situation 
meets "higher-than-nonnai risk" criteria will be made by the SAC or 
ASAC based upon assessment of the following factors: 

(a) Sub j ec ts— -number, motivati on, training ,^ 



propensity to violence, and other indicators. 

(b) Hostages (if any) — number, location, medical 
histories, etc. 

(c) Objective (crisis point) — location, 
defensibility, size configuration, avenues of approach, etc. 

(d) Weapons — types, numbers, lethality. 

(3) It is not the intent of this policy to place all 
raids and arrests in the hands of SWAT teams, but rather to reduce the 
risks to all personnel involved in those relatively few situations 
which would pose unwarranted danger if handled by traditional means. 
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EFFECTIVE: 01/18/91 



»'■• 



130-3.41 



Qualifications for SWAT Team Members 



Vfe 




(1) Agents assigned to primary SWAT teams in the 
field|must|have satisfactorily completed basic SWAT training at the 
FBI Academy; however, an Agent who has not met this requirement may be 
assigned to a primary team provided (a) he/she receives as much basic 
training in the field as possible and (b) that he/she satisfactorily 
completes basic SWAT training at the FBI | Academy, or the FBIHQ- 
authorized field equivalent using the SWAT lesson plans at monthly 
training sessions, fas soon as possible following his/her placement on 
a primary team. 

(2) Candidates for SWAT duty should be: 
(a) Volunteers. 
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| (b) In excellent physical condition. 

| (c) Emotionally stable. 

| (d) Proficient and confident in the use of small 

firearms; 

Experience as a police officer, military combatant, firearms, and/or 
defensive tactics instructor is also desirable. 

(3) It„is_desirable,_but_not_mandatory,_that_reserve_SWAT__ 



teams consist of Agents who have completed basic SWAT training. 

(4) It is also desirable, but not mandatory, that 
candidates have at least three years of experience in the field. 



EFFECTIVE: 01/18/91 
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4. 

' | | 30-3.5 | Reporting 

|As set forth in 30-1.8(1) (a) -(c) , each field office is 
required to submit semiannual crisis management reports. The 
following additional SWAT data is to be furnished as an enclosure in 
this designated format: 

I. New tactics, techniques, concepts of operation or 
equipment successfully employed in SWAT operations during the 
reporting period should be set forth. 

II. Problems encountered relative to SWAT operation 
during the reporting period should be included in the report. 



complement. 




III. Team status to include authorized SWAT 

A. Specialized training needed by yourjoffice. 

B. Official name of each primary team member. 

C. Identity of senior team leader (and 
subordinate team leaders if more than one team). 

D. The identity of SWAT advisor. 
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E. The identities of primary team members who 
have not | completed! basic SWAT training. 

F. Number of days | and hours [devoted to team 
training this (reporting period, broken down by tactical subject. | 

[Semiannual reports should include an FD-39, reporting firearms 
qualification scores. | 



_EFFECTJVE:_01/.18/.91_ 
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[30-3.6 



Training 

(1) At Quant ico: 



(a) Basic SWAT training will consist of a two-week 
course at the FBI Academy. 

(b) Specialized in-service courses will be held 
every two to three years or as required. 

(c) Only primary team members will be eligible for 
SWAT training at the FBI Academy. 

(2) In the field: 

(a) Training will consist of a minimum of the 
equivalent [of one day per month, except district teams which are 
mandated to conduct a minimum of two days of training each month. | The 
maximum is to be determined by the SAC and his/her special needs, but 
this training is not' to exceed five days per month. Any request in 
addition to the five days per month must be fully justified and 
approved by SOARU, Training. Division, FBIHQ. 

(b) Each| field office SWAT team will participate in . 
one regional training session per year where the host office conducts 

a CPX/FTX. The SWAT team will also participate in" the one mandatory 
crisis management training session per year in their respective field 
office. | 

(c) | The SAC | must personally participate | when his/her 
office is hosting a regional training session. | This responsibility is 
not to be delegated. 
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EFFECTIVE: 01/18/91 



| [ 30-3. 7 | 



Management of SWAT Teams 



(1) To fully utilize the effectiveness and capability of 
SWAT teams, the direct tactical command of the units must be delegated 
to the team leader by virtue of his/her training with the team and 
his/her familiarity with its capabilities. This in no way alters the 

overall„command_r.esponsibility_and^authority_of_the_SAC_within..his/her_ 

| field|office.| 

(2) (The SAC or his/her designated representative must 
assume the responsibility of OSC during a crisis incident. It is the 
duty of the SAC/OSC to determine the overall strategy for responding 
to and/or resolving a crisis incident. The SWAT team leader will then 
devise specific tactics/procedures to support the SAC/OSC's strategy. 
These tactics/procedures are all subject to the approval of the 
SAC/OSC, with the exception of emergency self-defense measures and 
immediate-response deployment. It is the responsibility of the SWAT 
team leader to personally direct the team in the execution of an 
approved plan. | 

| (3) j Time and circumstances permitting, an inspection of 
personnel and a rehearsal of the tactical plan should be conducted 
before the plan is executed. 

| (4) | SWAT team deployment on a regional|or district 
basis, or when the HRT is operationally deployed, will | be supported by 
the SAC from the host [office, | or his/her ASAC in the event he/she is 
not available. This individual (will | promptly designate a senior SWAT 
leader as the overall tactical commander and ensure that the chain of 
command is understood by all personnel present. 



EFFECTIVE: 01/18/91 
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(1) Any confrontation should be managed with minimal use 
of weapons fire. ' . 




■•A. 



(2) Much emphasis is placed on fire discipline during 
initial SWAT training and must continue in field training. Personnel 
on the scene of a confrontation who have not had SWAT training must be 
thoroughly briefed by the senior SWAT team leader concerning use of 
firearms in the context of problem solution. 

(3) Use_of.|.deadly|.for.ce_.by_SWAT_personnel._is_governed_by_ 



the same policy applicable to all Special Agents. 
12-2.1.)! 



(See MIOG, Part II, 
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(4) Meeting the above criteria, however, does not justify 
indiscriminate "area" type firing. All use of firepower must be 
preceded by acquisition of a known hostile target. This does not 
preclude the directing of selective suppressive fire at a low 
visibility target (such as a window from which gunfire is emanating) 
to cover movement of personnel, rescue of wounded individuals or 
evacuation of innocents. 



(5) The use of shotgun breaching as a forced entry 
technique in authorized for all SWAT teams. (However, appropriate 
training is required as set forth in MAOP, Part II, 8-9.) It can be 
deployed concurrent with SAC approval, consistent with FBI deadly 
force guidelines, using only Bureau-approved frangible shotgun rounds. 
Using frangible rounds does not create unreasonable risks; those risks 
that may exist can be mitigated by ensuring that in each case where 
the use of this technique is contemplated, the following factors are 
carefully weighed: 



m 






(a) The presence and number of individuals inside 
the building to be breached; 



breached; 



(b) Proximity of those individuals to the area to be 



-■''W'i- 

: iff* 



(c) Whether innocent persons are at risk; and 

(d) The risk of primary or secondary fragmentation. 
See MAOP, Part II, 8-9.3(4). 
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(6) Likewise, the use of chemical agents must be 
extremely judicious, with a minimum number of grenades injected to 
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dislodge subject (s) . Use of chemical agents also necessitates standby 
fire-fighting equipment. Explosive ordnance disposal technicians may 
be required to remove dud 40 tarn munitions. | (See MIOG, Part II, 
12-14.1 and 12-14.2 for chemical agent policy and procedures.)! 
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EFFECTIVE: 04/07/97 
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||30-3.9| Joint Operations 



(2) Due to the wide divergence of training, procedures, 
and professional competency of police SWAT units, the integration of 
police and' FBI teams in a given operation should be approached with 
caution. from standpoints of effectiveness, safety, and legal 
liability. If necessary to combine units, teams should remain intact 
and be separated by function. For instance, in a raid requiring joint 
operations, police SWAT units might be assigned the cover function and 
FBI teams the apprehension function. But under no circumstances 
should personnel from police SWAT units be integrated into FBI teams 
or vice versa. 



■■*v 



(1) Many FBI operations involve close work with other law 
enforcement agencies; and from a realistic viewpoint, it is realized 
that this relationship may necessarily extend to raid and arrest 
situations involving FBI and police tactical units. 






. t-v. » 
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(3) In joint-operations, it is imperative that unified 
tactical command be established at the outset with one person clearly 
in charge of all operations within the inner perimeter, preferably the 
most experienced FBI SWAT leader present. Briefing in preparation for 
joint operations should follow the "operations order" format as set 
out in Training Division j handouts. | 

(4) It is realized that arbitrary assumption of command 
by the FBI, particularly if police units are first on the scene as 
they frequently are, could be a sensitive and provocative maneuver 
requiring tact and diplomacy on the parts of the SAC and senior SWAT 
team leader. x - - 

| (5) | The decision to engage in|a| joint operation must be 
made by the SAC and should be "based on recommendations of the senior 
team leader, his/her unit, and all other factors bearing on mission 
safety and effectiveness. 
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'' : '"-' | (6) | In confrontations necessitating employment of force 
involving an' extraordinary degree of risk and which, in the judgment 
of the SAC, exceed FBI | SWAT (capability, the AD, CID, or AD, INTD, 
FBIHQ, or their representative should be advised in the event, 
special ized|HRT | intervention may be requested. 



EFFECTIVE: 01/18/91 • 
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1 30-3. 10 



Weapons 
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Certain weapons in the FBI arsenal were acquired 
specifically for SWAT applications and should be assigned to team 
members for their exclusive use. They are: 










FBI firearms instructors may utilize these weapons when instructing 
SWAT personnel. 



EFFECTIVE: 01/18/91 
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I SECTION 31. DEPUTATION PROGRAM 



'•}■■£ 



31-1 



BACKGROUND 




f! 



(1) Historically, the Attorney General has had the 
authority to supervise and direct the United States Marshals Service 
(USMS) in the performance of public duties. Specifically, the 
Attorney General is empowered to authorize the appointment of Special 
Deput y U.S. Marshals. In June 1984 , this authority was dele gat ed to 



the Associate Attorney General. The Associate Attorney General 
exercised his authority to direct the USMS to deputize state and local 
law enforcement officers to enable those officers to handle federal 
law enforcement functions while under the supervision of the FBI. 
Neither the FBI nor the Drug Enforcement Administration had 
independent deputation authority. 

(2) Effective 10/27/86, Title 21, United States Code, 
Section 878 was amended by the enactment of the Anti-Drug Abuse Act of 
1986. This legislation added state and local law enforcement officers 
to those who may be deputized by the Attorney General to carry 
firearms, execute warrants, serve subpoenas, make arrests and 
seizures, and carry out other federal drug law enforcement duties as 
determined by the Attorney General. The Attorney General no longer 
had to rely on the USMS to deputize officers assisting) the FBI in [drug 
investigations. In fact, the USMS | had | taken the position that it does 
not have the authority to make drug-related deputations. The Attorney 
General has delegated this deputation authority to the Director and on 
8/4/87, the FBI assumed responsibility for deputizing officers 
assisting in FBI drug investigations. |On 3/24/95, the Director 
delegated Title 21 deputation authority to Special Agents in Charge 
(SAC) . I An FBI-deputized officer is referred to as a Special 
"Federal I Officer (SFO) . | The Deputation Program is managed by the 
I Administrative Unit, Operational | Support Section, Criminal 
Investigative Division (CID) . . 
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| 31-2 SCOPE OF DEPUTATION AUTHORITY 

(1) Special Federal Officers are authorized to investigate, 
under FBI supervision, violations of Title 21 and those drug-related 
violations falling within the FBI's jurisdiction that arise out of an 
investigation predicated on drug violations. 

(2) The scope of this authority is limited to those' 
violations that are so inextricably linked to the Title 21 predicate that 
it could be fairly said that they would not have been engaged in separate 
and apart from the drug violations. 





(a) For example, if during a drug investigation it was 
established that the subjects were engaged in money laundering, it would 
be reasonable to conclude that the subjects would not have engaged in 
this activity absent their primary involvement in drug trafficking. On 
the other hand, if during a drug investigation it was determined that the 
subjects were engaged in criminal activity totally unrelated to their 
drug trafficking, it would not be reasonable to conclude that there was 

a connection between the two violations. 

(b) The fact that a nondrug violation is developed 
during a drug investigation is insufficient to empower a Special Federal 
Officer to investigate the violation if it did not arise out of the Title 
21 predicate offense. 

(c) Special Federal Officers do not possess general 
authority to act as FBI Special Agents. 

(3) The USMS remains responsible for deputizing officers 
participating in FBI investigations which do not fall within the scope 
of the FBI's drug deputation authority. The USMS will not deputize 
officers to participate in Federal drug investigations. 

EFFECTIVE: 01/22/90 
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31-3 



CIVIL LIABILITY 



. &$* 



(1) Special Federal Officers are considered Federal 
employees for purposes of civil suits brought under the Federal Tort 
Claims Act (FTCA) . The FTCA provides that the exclusive remedy for 
common-law torts committed within the scope of a Federal employee's 
employment (e.g. , a Special Federal Officer) is an action against the . 
United States under the FTCA. Therefore, Special Federal Officers who 
allegedly commit common-law torts while acting within the scope of their 
authority as Special Federal Officers cannot be sued in their individual 
capacities. The suit must be brought against the United States and a 

_resul.ting_judgment_for_monetary_damages.,_if_any,_wiJLbe„ satisfied^ by Jthe 

United States rather than the individual Special Federal Officer. 
Specifically, judgments in excess of $2,500 will be paid out of the 
United States Treasury rather than from FBI appropriations. 

(2) Suits brought against a Special Federal Officer for 
alleged violations of a person's constitutional rights (i.e., Bivens 
actions) are not brought against the United States but rather against the 
Special Federal .Officer in his/her individual capacity. An adverse 
judgment for monetary damages, entered against a Special Federal Officer, 
must be personally satisfied by the Special Federal Officer. However, 
the Department of Justice (DOJ) may provide legal representation to a 
Special Federal Officer and may indemnify the officer if it determines 
that the officer acted within the scope of his/her authority and that 
representation and indemnification would be in the interest of the United 
States. 

(3) The possibility of civil liability and its potential for 
adversely impacting on FBI investigations requires that there be tight 
control and direction over Special Federal Officers. Close supervision 

of these officers is of critical importance and must be recognized by 
field office management. 
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EFFECTIVE: 01/22/90 
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GENERAL OR CASE-SPECIFIC AUTHORITY 
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(1) Generally, the deputation authority granted to a 
Special Federal Officer is restricted to specifically designated 
cases. The cases on which a Special Federal Officer is authorized to 
work are listed by file number on the FD-739 (Oath of Office and 
Credential - Special Deputation) and FD-739a (Credential Card). The 
officer is prohibited from assisting on any FBI investigation not 
reflected on these forms unless doing so under his/her normal police 
powers. All deputations in Organized Crime Drug Enforcement Task 
Force (OCDETF) cases are handled on a case-specific basis only. | (See 
-MI0G,_Par.t_II,_31r5(7).(d)..)-| _____„ — — — _, 



(2) There may, however, be situations where general Title 
21 investigative authority is justified in non-OCDETF drug 
investigations. 

J0ften| officers are detailed to FBI | operational j squads on a full time 
semipermanent basis. These officers occupy FBI space 
and function much the same as Special | Agents. | The squads /may have a 
large number of drug cases open and cases are constantly being opened 
and closed. Under these or similar circumstances a request for 
general deputation authority may be appropriate. Such justification 
should be included in the initial deputation request submitted to 

(the SAC. I 



-a.'- 
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EFFECTIVE: 08/09/95 
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31-5 



GENERAL ADMINISTRATIVE MATTERS 




(1) A deputation request will be approved in only two 
circumstances: 

(a) The officer will be monitoring a Title III; 

(b) The officer will be conducting investigation 
outside his/her own jurisdiction. 

(2) When initially deputized, all officers must be sworn 
in by an SAC, or in his/her absence, an ASAC. 

(3) | Title 21 deputation authority may be granted by the 
SAC for a period not to exceed 24 monthsi Unless otherwise specified, 
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all FBI deputations automatically expire on October 1st of the second - 
12 month period in' which the deputation was approved by the SAC. | This 
expiration date appears on the FD-739 and FD-739a. (EXAMPLE: If an '. 
SFO is deputized in June, 1995, that authority may continue, 
uninterrupted, until October 1, 1996 or for a period of 16 months. 
Prior to October 1, 1996 that SFO's deputation authority may be 
renewed, with SAC approval, for an additional 24 months to expire on" 
October 1, 1998. | The sponsoring field division is responsible for 
monitoring deputation expiration dates and for submitting timely 
renewal requests|to the SAC, or in his/her absence, the ASAC. j 

(4)— |lf_the-deputation-request_involves-a-renewal_of_an 

existing deputation authority, the SFO does not need to appear before 

the SAC, ASAC, or the case Supervisory Special Agent, to be |p 

resworn, ,|as long as the deputation is renewed prior \J| 

to|deputation| expiration date. A deputation renewal may be 

accomplished by submitting a timely | renewal | request j to the SAC and 




over|SFOs 
31-3(3).) 



(6) The following requirements apply to all FBI 



(a) The officer's immediate FBI | case | supervisor must 
be identified on the FD-739; 

(b) The officer must review the Memorandum to\All 
Employees 6-89, dated 9/27/89, captioned "Principles of Ethical 
Conduct for Government Officers and Employees." The Manual of 
Administrative Operations and Procedures (KAOP) , Part I, 1-1 (9) , |may 
also be used in the absence of this memorandum. The officer should 
also be advised that he/she will be expected to abide by these 
standards of conduct for the duration of their deputation and failure 
to do so may result in the termination of their deputation. 
(See MIOG, Part II, 31-6(1) | (e) .) | 



Sensitive 
PRINTED: 02/18/98 



:0z 






v^U"^ 



having the SAC or, in his/her absence, the ASAC, |execute the Xi ;^| 

Deputation Statement on a new FD-739. The officer and SAC or, in V^Cljl" 

his/her absence, the ASAC then subscribe to the Acknowledgement/Oath ' j isMi 

of Office on the | new | FD-739. The SAC or ASAC must also sign the FD- ?|& 

739a. This must be accomplished prior to the expiration of the ' .-S& 

current deputation. ^ssSa 

"If? 

(5) Close supervision of|SFOs|is of critical importance. \;:*$k. 

The potential for civil liability and adverse impact on investigations r .||| 

is such that it is vital that there be tight control and direction "§M 

and their efforts on the FBI's behalf. I (See MIOG, Part II, ''J$g 

''^1 









deputations: •'- . ' ' -Z&%jr. 
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(c) The officer's deputation authority shall be -i.' 
terminated immediately by the sponsoring field division when it 

determines that the deputation is no longer necessary,, e.g., the '^ 

officer retires or resigns, is reassigned to other duties, the ..$£ 

investigation is closed, etc. The officer must be specifically _ '■;'<■, 

advised that his/her authority asjan SFO|is being terminated. The :•! 
officer's credential card (FD-739a) must be recovered and sent to 

[the SAC | as an enclosure to|a memorandum | notifying) the SAC | of the " '."'. 

termination of the deputation. """'.V, 

(7) The officer will also be required to acknowledge in '" ! i- 
_w^Jing_pn_the_FEt7.39_.that__he/she_has__been_giyen_instructions„set : j * v ■■ 

forth below, understands them, and will adhere to them. These ■'/ 

instructions are located on the reverse side of copy 3| (white) |of the ""; 

FD-739. ■"■ 

(a) The officer is not to travel out of state on FBI ' v ; ; 
business without being accompanied by a federal Agent unless 

specifically authorized by an SAC or, in his/her absence, an ASAC. £. 

(b) The officer is not to check federal prisoners 
out of a federal institution or holding facility unless accompanied by .:'",. 
a federal Agent. 

(c) The officer is authorized to monitor a federally -•#-. 
authorized Title III, acting under the supervision of a federal law •'£, 
enforcement officer. ^>j 

(d) The officer is deputized only for the specific >: 
case(s) authorized in the request for deputation. The officer is not re- 
authorized to work on any other federal investigation without specific 
approval. This deputation is not a general authority to act as a 
federal Agent. 

(e) While this deputation may result in the officer 
not being liable under Section 1983 actions, the officer is reminded 
that he/she may nevertheless be liable for BIVENS-type actions. 

(f) While engaged in the investigation of cases 
being directed by the FBI, the officer will remain at all times during 
the period of this deputation subject to the direction and control of 
the FBI. 

(8) The FD-739a is not intended to be used as a means of 
primary identification. Any alteration of the FD-739a is specifically 
prohibited. This includes use of stand-alone credential cases, 
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photographs, official seals, reproductions, or unauthorized 
signatures. • . ' 

-* |(9)By October 1st, of each year, SACs are required to 

submit annual summary reports, by airtel, captioned "FYXX DEPUTATION 
SUMMARY REPORT," to the Administrative Unit, Operational Support 
Section, CID, which identifies all currently approved SFOs. 



following: 



(a) These summary reports should include the 



_1. F_ull_Name_ 



| 2. State or Local Agency 

| 3. Date Deputized 

| 4. Expiration Date 

.v | 5. OCDETF Investigation, file number; 

I I Non-OCDETF Investigation, file numberj 



EFFECTIVE: 08/09/95 
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31-6 DEPUTATION REQUEST PROCEDURES "<: 

(1) Title 21 Investigations % 

(a) All deputation requests must be closely /A 
coordinated with the U.S. Attorney's Office to ensure compliance and 

timely completion. All requests should be submitted at least 30 days -:' 

prior to the time the deputations are required. 

(b) The requesting field office must submit a "Title 
21 Deputation Request" Memorandum (FD-815) , for approval, to the 
sponsoring field office SAC. The request must have the original 
signatures of the SAC, case Supervisory Special Agent, and the 
authorized state or local law enforcement official. 

(c) The requesting office must conduct DEA (NADDIS) 
and FBI (NCIC and field office indices) name checks on all officers to 
be deputized. The signature of the case Supervisory Special Agent 
certifies that these name checks have been completed and are negative. 
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enforcement official certifies that the officer to be deputized- is not ■ " .•!&£ 

W A -." 



In addition, the signature of the "authorized state or local law 



the subject of any internal investigations. Finally, the signature of 

the SAC certifies that the officers to be deputized have been advised .^ 

of and agree to comply with the instructions set forth in the "Title 

21 Deputation Request" Memorandum (FD-815) , 



(h) After the FD-739 has been signed by the SAC or 
ASAC, the FD-739a (Special Deputation Credential) should be detached 
from copy 3 (white) of the FD-739 and given to the SFO. Copy 1 (blue) 
of the FD-739 is also given to the SFO. Copies 2 (green) and 3 of the 
FD-739 should be maintained in the requesting office's deputation 
control file. 

^ (i) Officers deputized for a non-OCDETF drug 

investigation do not need to be redeputized in the event the 
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(d) Upon approval of the FD-815 by the SAC or^ in 
his/her absence, the ASAC, the requesting office is responsible for 

preparing the Oath of Office and Credential-Special Deputation ;^| 

(FD-739), securing the appropriate signatures and submitting the 
J r Dn739_to_the_SAC-for_deputation_authority — - 



,---^ 



(e) The sponsoring office must review the deputation 
forms for accuracy, particularly file numbers. Any needed corrections 
should be made and needed descriptive information on the officer 
obtained. The officer must review the Memorandum to All Employees 
6-89, dated 9/27/89, captioned "Principles of Ethical Conduct for 
Government Officers and Employees." ' In the absence of this memorandum 
the MAOP, Part I, 1-1 (9), may be substituted. The officer should be 
'■% advised that he/she will be expected to abide by these standards of 

conduct for the duration of his/her deputation and failure to do so ^ 

may result in termination of their deputation. The name of the ' L _ 

officer's FBI case supervisor must be entered in the space provided on "g 

the FD-739. (See MIOG, Part II, 31-5(6) (b).) ^ 
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(f) The instructions located on the reverse side of 
copy 3 of the FD-739 regarding the officer's responsibilities as an 

SFO must be given to the officer and acknowledged by signing and '.« 

dating in the space provided. "'M 

(g) When initially deputized, an officer must take -:£p 
the oath of office as presented on the FD-739. The SAC, ASAC, or a \#; 
Supervisory Special Agent may administer the oath. Both the officer /"S? 
and the SAC or ASAC must sign and date the FD-739 in the spaces 
provided. 
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1. Identify by title and file number all 
investigations on which the officer will be working. If general 
deputation authority is requested, no titles and file numbers are 
required; however, full justification must be set forth. Note that 
while an FBI deputation is routinely case specific, USMS deputation 
authority extends to all federal violations except Title 21. 

2. Complete description of the officer, 
including full name, employing agency, date of birth, |social security 
number, | height, weight, sex, race, eye and hair color. 

3. Results of field office indices name check, 
NCIC check, NADDIS check, and a check of the officer's employing 
agency internal affairs office. 

A. U.S. Code violations being investigated. 

5. Last firearms qualification date. It must 
be within the past year. 



experience. 



6. Number of years of law enforcement 



7. Contact Special Agent in requesting office. 



(c) FBIHQ will prepare a deputation request and 
forward it to USMS Headquarters. The requesting office (contact 
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investigation is converted to the 245 classification. 

(2) Non-Title 21 Investigations; Drug Violations . 

Anticipated 

(a) .Occasionally, deputations may be required for 
cases not predicated on Title 21 violations; however, Title 21 >V 
violations are anticipated. This very narrow category requires 

deputation by both the FBI and the USMS. ^r 

(b) A Non-Title 21; Drug Violations Anticipated, : |k 
..deputation._request_can_be-.accomplished_by._fol lowing the. procedures _________ ^Un- 
required for Title 21 investigations and submitting anj electronic * -y: 
communicationjfrom the SAC, under the caption "FBI Deputation 
Authority; Non-Title 21 Investigations; Drug Violations Anticipated" 
to the attention of the Administrative Unit, Operational Support 
Section, CID. The request must include the following information. 
(See MIOG, Part II, 31-6 (3)(b).) 
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Special Agent) will be contacted by the local USMS office in order to 
arrange for the deputations.. 

(d) A copy of the approved FD-815 must accompany the 
[electronic communication (requesting Non-Title 21 deputation request. 

(3) Non-Title 21 Investigations; Drug Violations Not 
Anticipated 

(a) Officers assisting in investigations which do 
not involve drug violations are only deputized by the USMS. 



(b) The Non-Title 21 Investigation; Drug Violations 
Not Anticipated deputation request can be accomplished by submitting 
anlelectronic communication! from the SAC, under the caption "FBI 
Deputation Authority; Non-Title 21 Investigation; Drug Violations Not 
Anticipated" to the attention of the Administrative Unit, Operational 
Support Section, CID. The request must include the information set 
forth in Section 31-6 (2) (b) . 

(c) FBIHQ will prepare a deputation request and 
forward it to USMS Headquarters. The requesting office (contact 
Special Agent) will be contacted by the local USMS office in order to 
arrange for the deputation. 
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EFFECTIVE: 05/22/96 
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32-1 



REWARDS 



A reward is a sum of money or other premium offered by the 
Government or by a private person for the performance of some special 
or extraordinary service. By their very nature, offers of rewards are 
usually made to the public or to a class of persons and, as such, 
.differ„from_the_usual-payments-to_informants_set_.forth_.in_Part_I,__ 

| 137-8, | of this manual entitled, "Payments to Informants." 



EFFECTIVE: 12/20/93 





I I 32-; 



AUTHORIZATION 



(1) Authorization to offer and pay rewards is in 
accordance with current confidential funding guidelines as herein set 
forth: 



(a) Special Agent in Charge (SAC) - 

(b) Section Chief 

(c) Deputy Assistant Director 

(d) Assistant Director 

(e) Associate Deputy Director 



$20,000 

$50,000 

$150,000 

$250,000 

over 



$250,000 



(2) The SAC must approve each reward offer up to 
$20,000. At the time the reward is paid the field office informant 
budget will be charged for the amount of the reward payment. If an 
SAC desires to offer a reward in excess of available funds, he/she 
will request additional funding and authorization from the appropriate 
FBIHQ substantive section prior to offering the reward.-. This 
communication should specify the amount of the requested reward offer 
and a detailed justification .which addresses 32-4, (l)(a)-(f) below. 
(See 32-4(4) below.) 
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EFFECTIVE: 10/07/93 



| 32-3 



CRITERIA (See 32-4 below.) 



(1) Rewards should only be offered on a selective 
basis in cases which normally have the following characteristics: 



~™ ~~ (al A significant investigation. 

(b) Logical avenues of investigation have either 
been concluded or appear unfruitful. 

(c) Individual (s) who may be in possession of , 
useful information are more . likely to be motivated by money as opposed 
to civic duty. 

(2) Issues associated with the offering of reward that 
must be considered are the following: 

(a) The legitimate fear that the public offering 

of a large sum of money could result in the receipt of spurious 

information and the concomitant need to utilize resources to resolve 
the truthfulness of the information. 



the reward. 



(b) The problem of deciding who is entitled to 
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32-4 REPORTING r 

(1) Where appropriate, the FBIHQ substantive unit 
should receive UACB notification of the reward offer under the 
appropriate case caption setting forth the following information: 
(See 32-2(2) above.) ~ . 

(a) A detailed narrative of the investigation. 

(b) The amount of the reward to be offered. 



(c) Detailed justification which addresses the 
issues in 32-3 above. 

(d) The criteria by which an individual will be 
considered eligible, i.e., "For information leading to the 
identification, arrest and conviction of the subject of. the 
investigation," or in a kidnaping matter, "for information leading to 
the recovery of a kidnaping victim and the identification, arrest and 
conviction of the persons responsible." 

(e) The identities of the local news media by 
which the reward offer will be made. 

(f) The prepared text which will be provided to 
the local news media. 

(2) All reward offers in this regard should be in 
strict accordance with the instructions set forth in the Manual of 
Administrative Operations and Procedures, Part II, 5-1, entitled, 
"Policy and Guidelines for Relations with News Media, and 5-2, 
entitled, "Contacts with News Media." 

(3) The appropriate FBIHQ substantive unit should 
receive, UACB, airtel notification that a reward recipient has been 
selected and the basis for the selection. 

(4) In those cases where FBIHQ authorization is 
required, the procedures set forth in 32-2 (2) should be followed. | 



EFFECTIVE: 10/07/93 
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1 32-5 ATTORNEY GENERAL REWARDS FOR INFORMATION CONCERNING 
ESPIONAGE AND TERRORISM CASES 

(1) Title 18, USC, Section 3071, provides the Attorney 
General with the authority to pay rewards to individuals furnishing 
information in connection with acts of espionage or terrorism when 
such information: 

(a) leads to the arrest or conviction, in any 
country, of any individual for the commission of espionage or 
terrorism against the United States; _^__^_ - 



coun 
ac 



(b) leads to the arrest or conviction, in any 
untry, of any individual for conspiring or attempting to commit an 
t of espionage or terrorism against the United States; or 



(c) leads to the prevention, frustration, or 
favorable resolution (in terrorism cases) of an act of espionage or 
terrorism against the United States. 

(2) The Attorney General determines whether an individual 
providing information concerning acts of espionage or terrorism is 
entitled to a reward and the amount of the reward. The maximum 
reward amount is $500,000. Any reward of $100,000 or more must be 
approved personally by the President or the Attorney General. 

(3) The Attorney General may take such measures in 
connection with the payment of the reward to ensure that the 
identities of the recipient and the recipient's immediate family are 
protected. 

(4) No officer or employee of any governmental entity is 
eligible for any monetary reward under Title 18, USC, Section 3071, 
if that person provides information concerning espionage or 
terrorism while in the performance of his or her of ficial duties. 

(5) Any individual who furnishes information that 
justifies a reward by the Attorney General may, in the discretion of 
the Attorney General, participate in the witness security program. | 
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j SECTION 33. NATIONAL DRUG INTELLIGENCE CENTER (NDIC) 



33-1 NATIONAL DRUG INTELLIGENCE CENTER (NDIC) 

The NDIC is a multiagency entity operating under the 
direction of the U.S. Attorney General. The mission of the NDIC is to 
develop organizational and strategic drug intelligence in support of the 
U.S. law enforcement community, Intelligence Community, and policy 
makers. NDIC ' s ■ mandate necessitates the collection of detailed and 
relevant information concerning drug enterprises and drug trafficking 
patterns. On May A, 1993, the FBI agreed in a Memorandum of 
Understanding (MOU) to provide NDIC unrestricted access to FBI historical 
and active investigative information concerning drug trafficking. The 
following procedures are intended to ensure NDIC's timely access of 
relevant FBI drug information with appropriate FBI review. 



EFFECTIVE: 02/17/94 



33-1.1 NDIC Interaction with FBI Field Offices 

NDIC may obtain FBIHQ approval to interact directly with FBI 
field offices . 

(1) NDIC will request by written communication FBIHQ 
approval for NDIC access to specified field offices and FBIHQ elements 
in furtherance of NDIC's information needs for specified project areas. 
The Section Chief, Intelligence; Sect ldhv/'Ociminat Investigative'; J3ivisi on 
(CID) or designee, after consultation with the appropriate operational 
section, will be responsible for approving- NDIC requests. 

r - '.••»"<' ■'■■ ■-■ ■ ' ■■'■'. • ; ■■• ■■■< 

(.2) The affected field offices will be notified by teletype 
which will detail the scope of NDIC's information needs for specified 
projects and will include the NDIC point of contact. This teletype will 
serve as notification of NDIC that their information request has been 
approved by FBIHQ. 

(3) Upon receipt of the teletype, NDIC will communicate 
directly with the identified FBI field offices and FBIHQ elements. NDIC 
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will direct copies of all NDIC communications with FBI field offices to .^^ 

the Intelligence Section, CID, FBIHQ. / ^0i 

' " .*. " ■ ■ ' "Hi*? 

(4) Significant changes in the scope or direction of the *|e*. 

project which impacts on FBI resources will require additional Section *'". 

Chief, Intelligence Section, CID approval. ,-■' . **&& 

/" / ' '■' ".V" 



EFFECTIVE; 02/17/94 



$0$ 
33-1.2 NDIC Analytical Support for FBI Drug Investigations ggF 

FBI field offices may receive' NDIC analytical support for '^fl 

ongoing FBI drug investigations. The 'following procedures are in place . ^^. 



for field offices desirous of NDIC analytical case support: 



(4) Upon NDIC approval of the request, NDIC will notify the 
field of f ice' and FBIHQ by teletype. NDIC will then coordinate the 
analytical support directly with the field office. 



EFFECTIVE: 02/17/94 
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(1) The field offices will submit a request to the Sensitive 
Information Unit, Intelligence Section, CID, by teletype. The teletype ' .^| 
should provide an overview of the investigation including the. *■" 
identification of the core organization being addressed. iZ 

■' ■•% 

(2) The Section Chief, Intelligence Section, CID, or ■.. -- 

designee, after consultation with the appropriate operational section, ilp. 

will review field office requests and prioritize the requests in -'^' 

accordance with the FBI Organized Crime/Drug National Strategy. ^: 



sets. 



(3) Approved requests will be forwarded to NDIC by teletype 
for their evaluation and determination if sufficient resources are S% 

available to support the investigation or project. 
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33-1.3 " NDIC Access to FBI Automated .Information Systems (AIS) 

• ■ , • . " '■/,/'■ • • "■"■ 

f- (1)^ NDIC will have access to the following FBI AIS: 

- Field Office Information Management System (FOIMS) 

- FOIMS Telephone data base .„•.'". 

- FBIHQ General Index 

-|Criminal Law Enforcement Application (CLEA) | 

- Investigative Support Information System 

(2) Only a select number of NDIC Intelligence Research 
-Special ists-(lRS)-will~be- author ized.access_to_FBI_AIS.____ 

(3) The designated IRSs will query the data bases and, when 
positive results occur, they will make a recommendation concerning the 
need for other NDIC personnel to see the data. 

(4) The data retrieved from the FBI data bases, along with 
the recommendation, will be reviewed by an FBI Supervisory Special Agent 
(SSA) detailed to the NDIC. The review will include a finding as to the 
relevancy of the FBI data to NDIC projects and a determination whether 
the information should be disseminated to other NDIC personnel. 

(5) The NDIC IRSs and SSAs. will be subject to the same 
personnel rules, regulations, laws, and policies applicable to all FBI 
employees. 
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EFFECTIVE: 11/25/94 



33-1. A NDIC Access to Informant Files and Grand Jury Material 

(1) NDIC will not be provided access to FBI informant files. 
FBI field offices will determine what level of access NDIC may have to 
informant information contained in the substantive case files. This is 
not intended to deny NDIC access to the information, rather it is 
intended to protect the identities of FBI confidential informants and *. 
cooperating witnesses. 

(2) NDIC will not be provided. access to Grand Jury 6E 
material unless specifically requested by the field office and in 
compliance with all applicable 6E rules. 
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| 33-1.5 NDIC Dissemination of FBI Information. / 

NDIC will not disseminate FBI information' to other- agencies 
without the concurrence of the Section Chief, Intelligence Section, or 
designee and in accordance with mutually agreed upon dissemination 
procedures. The Section Chief of the Intelli g ence Section, CID or 



designee will be the FBI approving authority for NDIC dissemination 

issues. | v- ..' 
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1 33-1.6 NDIC Document Exploitation Branch Service (DocEx) 

-.'■'. 

(1) To further the NDIC's mission of supporting drug law 
enforcement, the DocEx was created to assist in the storage and analysis 
of drug-trafficking information obtained through law enforcement 
activities. The DocEx was established to assist field operations with 
time-sensitive analysis of information seized pursuant to search 
warrants, subpoenas, or other enforcement actions which require immediate 
analysis. /' 

(2) The DocEx Branch consists of Special Agents (SA) and 
analysts available for/travel to field locations to assist in timely 
analysis of drug-related information. The DocEx is a field support unit 
and will not conduct unilateral investigations. All information 
developed by DocEx will be furnished to the field office of the 
requesting agencies. 

DocEx can provide the following services to field offices: 

(a) Forensic computer assistance. 

(b) Link Analysis of telephone toll records. 

(c) Link Analysis of associations and affiliations. 
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(d) Drug organization profiles.' 

(e) Financial analysis including identification of 

- (f) Time-line analysis. 



assets. 














(g) Access to public records databases. 

(h) Assistance to search scenes, including electronic 
inventory, electronic photography, and computer-generated floor plans. 



(3) Initial formal requests from FBI field offices for NDIC 
DocEx assistance should be sent to FBIHQ for approval. A copy of the 
initial request should be sent to NDIC. It should be in writing, setting 
forth a brief summary of the investigation, the priority of the 
investigation within the division and any known requirements concerning 
the anticipated volume of materials to be seized and the time frames for 
the enforcement activity. Requests should be forwarded to FBIHQ, 
Attention: Unit Chief, Intelligence Development Unit, Intelligence 
Section, Criminal Investigative Division. The NDIC copy should be sent 
to the National Drug Intelligence Center, 319 Washington Street, Fifth 
Floor, Johnstown, Pennsylvania 15901, Attention: Chief, Document 
Exploitation Branch. 

(4) The DocEx Branch should be contacted as far in advance 
of a proposed enforcement operation as possible. This timely 
notification will ensure that the DocEx team can work with the field 
offices in order to appropriately plan, staff, and support the timely 
analysis of seized documents. 

(5) After init/al coordination between FBIHQ and NDIC, field 
offices may thereafter correspond directly with NDIC regarding that 
particular case, keeping'' FBIHQ informed of any significant developments. 

(6) Upon receipt of an approved request at NDIC, a Team 
Leader (a DEA/FBI SA 'assigned to NDIC/DocEx) will contact the Field 
Supervisor or Case Agent for an assessment of the personnel and equipment 
needed to support an assignment. A Team Leader may also make an on-site 
assessment, if necessary. I 

(7) Materials provided to NDIC will be handled solely by the 
DocEx team and not released to any other agency until approval is 
obtained from the submitting agency. This is in accordance with policy 
set forth in the Memorandum of Understanding between the FBI and NDIC. 
Alt- information developed by DocEx will be returned to the requesting 
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agency's field office. 
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| SECTION 34. VICTIM/WITNESS ASSISTANCE (VWA) 



I 34-1 



INTRODUCTION 



*M 






Vet 






'4% 



The purpose of these MIOG guidelines is to establish 
procedures to be followed by the Federal Bureau of Investigation (FBI) 
in responding to the needs of crime victims and witnesses. 



EFFECTIVE: 09/08/94 










| 34-2 DEFINITIONS USED THROUGHOUT THESE GUIDELINES 

uP Th * term " victim " ffl eans a person that has suffered 
direct or threatened, physical, emotional, or pecuniary harm as a 
result of the commission of a crime,, including: 

wfifB .„ a <*> ] n the case of a victi » ^at is an institutional 
entity, an authorized representative of the entity, and 

(b) In the case of a victim who is under 18 years of 
age, incompetent, incapacitated, or deceased, one of the following (in 
order of preference): a spouse; a legal guardian; a parent; a child; 
court ' lly member '> «* another person designated by the 

(2) The term "witness" means a person who has information 
or evidence concerning a crime and provides information regarding 

iw*%E°? *" -J * 1 r. enf ° rCement a * encv ' Where the witnesf is a 
minor, the term "witness" includes an appropriate family member or 
legal guardian. ' 
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(3) The term "witness" does not include: 

(a) a defense witness; or 

(b) an individual involved in the crime as a 
perpetrator or accomplice. 
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(A) The term "responsible official" means the Special"'- 
Agent in Charge (SAC) of the division or his or her designee having 
the primary responsibility for conducting the investigation. 

.-v ' '.-'.-- .. ' ' ' • " •" . . - ' ' .- -, . . 

( 5 ) The term "earliest opportunity" or "earliest possible 
notice" means one that will not interfere with an investigation or 
hamper the responsible official in the performance of other law 
enforcement responsibilities. 

(6) The term "multidisciplinary child abuse team" means a 
professional unit composed of representatives from health, social 

-P.gyi.ce., law enfcjxement>_A"d leg al service a genci^s_to_coor dinate the 
assistance needed to handle cases of child abuse. 



34"- -:->• 2-- 



(7) The term "serious crime" (as used in the Victim and 
Witness Protection Act of 1982 (VWPA)) means a criminal offense that 
involves personal violence, attempted or threatened personal violence, 
or significant property loss. 

(8) The term "financial" or "pecuniary" harm shall not be 
defined or limited by a dollar amount, thus the degree of assistance 
must be determined on a case-by-case basis. For example, since 
victims' means vary, that which constitutes a minimal financial 
for one might represent a devastating loss for another. 



loss 



(9) The term "child" means a person who is under the age 
of 18, who is or is alleged to be: 

(a) A victim of a crime of physical abuse, sexual 
abuse, or exploitation; or s 



person. 



(b) A witness to a crime committed against another 













.%.■*& 




(10)The term "child abuse" means the physical or mental 
injury, sexual abuse or exploitation, or negligent treatment of a 
child. The term "child abuse" does not include, however, discipline 
administered by a parent or legal guardian to his or her child 
provided it is reasonable in manner and moderate in degree and 
otherwise does not constitute cruelty. 

(11) The term "abuse" combined with "physical injury" also 
means in any case which 

(a) . a child is dead or exhibits evidence of skin 
bruising, bleeding, malnutrition, failure to thrive, burns, fracture 
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of any bone, subdural hematoma, soft tissue swelling, internal 
injuries, or serious bodily harm; and 
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(b) such condition is not justifiably explained or 
may not be the product of accidental occurrence; and 

(c) any case in which a child is subjected to sexual 
assault, sexual molestation, sexual exploitation, sexual contact or 
prostitution. 
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(12) The term "local child protective services agency" 
-means_that^agency„of_the_federaL.government,_of_a ..s.tat.e.,_pr„o.f_a_l.ocal_ 
government that has the primary responsibility for child protection on 
federal land, or federally contracted or operated facilities. 

(13) The term "local law enforcement agency" means any 
federal, state or local law enforcement agency having primary 
responsibility for the investigation of an instance of alleged child 
abuse on federal land, or federally contracted or operated facilities. 

(14) The term "mental injury" means harm to a child's 
psychological or intellectual functioning which may be exhibited by 
severe anxiety, depression, withdrawal, outward aggressive behavior, 
or a combination of those behaviors, which may be demonstrated by a 
change in behavior, emotional response, or cognition. 

(15)The term "sexual abuse" includes the employment, use, 
persuasion, inducement, enticement, or coercion of a child to engage 
in, or assist another person to engage in, sexually explicit conduct; 
or the rape, 'molestation, prostitution, or other form of sexual 
exploitation of children; or incest with children. 



simulated: 



(16)The term "sexually explicit conduct" means actual or 
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(a) sexual intercourse, including sexual contact in 
the manner of genital-genital, oral-genital, anal-genital, or oral- 
anal contact, whether between persons of the same or opposite sex; 
sexual contact means the intentional touching, either directly or 
through clothing, of the genitalia, anus, groin, breast, inner thigh, 
or buttocks of any person with an intent to abuse, humiliate, harass, 
degrade, arouse or gratify sexual desire of any person; 

(b) bestiality; 

(c) masturbation; 
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(d) lascivious exhibition of the genitals or pubic 
area of a person or animal; 

(e) sadistic or masochistic abuse. 

(17)The term "exploitation" means child pornography or 
child prostitution. 6 v y 

(18)The term "negligent treatment" means the failure to 
provide, for reasons other than poverty, adequate food, clothing, 
.Jhejler, or medical care so as to seriously endan ger the physical 
health of a child. — — — — -'—* — - 
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(19)The term "best efforts" means that, in the spirit of 
full compliance with VWA legislation, Agents and employees engaged in 
the investigation or detection of a crime shall make their finest 
attempt to see that victims of crime are accorded the rights described 
in the Victims Rights and Restitution Act. 



EFFECTIVE: 09/08/94 



34-3 



VWA STATUTORY BACKGROUND 



These guidelines combine the requirements of the 
Victim and Witness. Protection Act of 1982 (VWPA) , Public Law (PL) 
97-291 (October 12, 1982), and the victims rights statutes contained 
in the Crime Control Act, PL 101-647 (November 29, 1990), which are 
Title V, Victims' Rights and Restitution Act of 1990 (VRRA) ; and Titie 
II, Subtitles D and E, Victims of Child Abuse Act of 1990 (VCAA) 
These laws were enacted to protect and enhance the necessary role of 
crime victims and witnesses in the criminal justice process, and were 
further interpreted by the 1991 Attorney General Guidelines for Victim 
and Witness Assistance (Guidelines). The Guidelines require 
Department of Justice investigative, prosecutorial and correctional , 
components to make their best efforts to ensure that victims of crime 
are treated with fairness and respect for the victims* dignity and 
privacy. " . 

The VRRA sets forth a federal Crime Victims' Bill of 
Rights which states that a crime victim has the following rights: 
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(1) The right to be treated with fairness and with 
respect for the victim's dignity and privacy. 

(2) The right to be reasonably protected from the 
accused offender. . s 

(3) The right to be notified of court proceedings. 

(4) The right to be present at all public court 
proceedings related to the offense, unless the court determines that 
testimony by the victim would be materially affected if the victim 

,hear.d^other_tes,timony_at__trial. 
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(5) The right to confer with attorney for the Government 
in the case. 

(6) The right to restitution. 

(7) The right to information about the conviction, 
sentencing, imprisonment, and release of the offender. 
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EFFECTIVE: 09/08/94 




34-4 



ELIGIBILITY FOR VWA 



(1) Witnesses (other than defense witnesses and 
perpetrators or accomplices of the crime) and victims may be 
considered for assistance through VWA. 

(2) In cases where the United States or the public are 
generally the victims (e.g., narcotics trafficking and tax evasion), 
victim services will be inappropriate; but in virtually ALL cases, 
there will be witnesses who will be entitled to witness services. 

k - , •„ ( £, ^ CiVil R£ghts cases that all *gedly involve police 
brutality, VWA should not be provided until such time that DOJ 
assesses the case. In Civil Rights/Inmate cases, VWA will be" 
inappropriate as inmates are already provided medical and mental 
health services free of charge by the institution in which they are 
housed. * ■ 
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34-5 OFFICE FOR VICTIMS OF CRIME (OVC) , DO J 

The OVC serves as the federal focal point for all crime 
victim issues. The Federal Crime Victims Division is one of three 
divisions within the OVC that is responsible for: 

Jill Ifeg^dj^ng^and Jj»proy_ing_seryices for victims _o f 
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federal crime; 

(2) Monitoring compliance with legislation pertaining to 

( 3 ) Providing training and technical assistance to 

| federal criminal justice personnel on victim assistance issues. 

EFFECTIVE: 09/08/94 

34-6 COORDINATION OF VWA MATTERS 
(1) FBI Headquarters 

(a) All matters pertaining to VWA, which involve the 
FBI, are coordinated through the Criminal Informant Unit (CIU) , 
Intelligence Section, Criminal Investigative Division (CID) FBI 
Headquarters (FBIHQ) . 

(b) The CIU acts in a liaison capacity with FBI 
field offices; with the OVC, DOJ; with other federal agencies which 
investigate criminal activity; and with U.S. Attorneys' Offices 
(USAOs). The CIU coordinates VWA matters, as appropriate, with other 
CID sections and other divisions at FBIHQ. 

(2) FBI Field Offices 

' . , ( ?) Each fiel <* office shall have a Victim/Witness 
Coordinator (VWC) designated by the SAC. 
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V - f b) Ea ? h division shall advise the CIU, FBIHQ, by 
days ^ 86S " ^ desi « nation of the VWC within 10 working 

on1l> „ . . . f c) Jach field office must establish written office 
policy determining who will perform the following duties: 

At the earliest opportunity after the detection of a 
eflorts 6 *^ A8<mt and/ ° r VWC ShaU make reasonable an <« diligent 



-Tr——— ~r~l Ident i £ y-the^victims_of_a_crime_and_inform- 

furth^r • II ri « ht .*« f«« iv «. on request, the services described 
further in these guidelines and; 
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„ NM ., „ T * ' . 1 ' Present the victim with a printed brochure, 
inform Lw^* °? W ^ims *nd Witnesses of Crime," which w 11 
n^ber or" Jhe Sk'J ! rEVTv"^' bU6ineSS addre "' Md telephone 
sht W be a^ressed "" ^ '° Wh °° SUCh * "* UMt *" S " Vic « 



„.. k„ -j „ .., *• In Civil Rights cases a pamphlet should 
ot be provided until DOJ accepts the case indicating contributory 
onduct was not a factor in the brutality. y 



,.». u u 3 * Upon reo *uest, after the victim has reviewed 

the brochure and requests services, the VWC or the Case Agent shall 

medlca HZ) '• ^ PUCe Where he/8he mav receiv « Agency 

b! ™ a 'M h /°°i a SerVlces ! compensation for which the victim may 

which J,lt "? ** thl \ 0r anv . other aPPHcable law; and the manner X 
which such relief may be obtained. 

„.„,. . . a> The vwc or the Case Agent shall, to the 

extent deemed necessary and feasible, assist in referring the victim 
to the specific person or office which will provide the above 
services. ««wv W 

... ,.,,':. V b * The res POn*i b le official or his or her 
designee sha 1 take appropriate action to ensure that any property of 
a victim that is being held as evidence is maintained in good - 

for* «vid2n a - retUrned U the VictiD aS SOon as £t i8 ™ ^nger needed 
for evidentiary purposes. , " ucu 

fill n »f ft., v ►• ,t\ The ! WC ° r the Case Agent is "quired to 
fill out the Victim/Witness Information form for all cases with 
victims noting if a pamphlet was provided. 
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5. Consult with and provide the victim or 
witness with the "earliest possible notice" concerning: 

a. the status of the investigation of the 
crime, to the extent that it is appropriate and will not interfere 
with the investigation; 

b. the arrest of a suspected offender. 

6. Upon request by a victim or witness, if 
_cooperation_in_the_inves.tigati.on_of_the_crime_causes his/her_absence_ 

from work, the VWC or the Case Agent shall notify the employer of the 
role of the victim or witness in the investigation through verbal or 
written communication. 

'• u P on written request by a victim or witness, 
if the victim or witness experiences problems with his/her creditors 
as a result of the victim's or witness' cooperation in the 
investigation, the VWC or Case Agent shall notify the creditor of the 
role of the victim or witness in the investigation through verbal or 
written communication. 
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EFFECTIVE: 09/08/94 
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34-7 



SECURITY OF COMMUNICATIONS AND FILES 




(1) To ensure that appropriate security is afforded 
communications relating to individuals contacted for VWA purposes, all 
such communications should be captioned with the individual's true 
name, followed by the words "VICTIM/WITNESS ASSISTANCE." Bureau 
regulations regarding the security and release of information is 
contained in the Manual of Administrative Operations and Procedures 
(MAOP), Part II, Section 5, 5-1, 5-2; and Section 9, 9-1 through 9-6. 

(2) The subclassif ication number 66F will identify 
Victim/Witness control files and should be used on all Victim/Witness 
communications. One copy of each communication should be placed into 
the control file, one copy in the field office's substantive file, and 
after the investigation is completed, one copy should be sent to the 
U.S. Attorney's Office. 
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(3) The FBIHQ control file number 66F-HQ- 1043 145 should 
be used on all written communications being forwarded to FBIHQ., 
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34-8 REPORTING DATA RELATIVE TO FBI FIELD OFFICES 
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| 34-8.1 Annual Best Efforts Report 

(1) FBI field offices MUST provide FBIHQ with statistics 
regarding their assistance effort as part of the "Best Efforts 
Questionnaire" by October 15 of each fiscal year and must include: 



investigation; 



cases; 



(a) The number of criminal cases opened f 



:or 



cases; 



(b) The number of victims involved in these 

(c) The number of child victims involved in these 



(d) The number of victims assisted by the field 
office's VWA effort; 



these cases; 



(e) The number of witnesses involved in 



ill 



(f) The number of witnesses assisted by the field 
office's VWA effort; 

(g) The number of cases in which the VWC was 
directly involved; 

(h) The number of full-time equivalent professional 
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(i) The types of "cases (i.e., white collar, 
sexual assault, drug-related) that most routinely involve the VWC. 

(2) Other issues that concern how well the program is 
working in the field office should be set forth in the space provided 
in the Best Efforts Questionnaire." The information from the "Best 

»« fort » 2 Ue ! ti ° rmair f wiU be utili «<* by FBIHQ to prepare the annual 
Best Efforts Report" which will be sent to the Attorney General 
through the OVC. This information will contain all of the 
aforementioned data for each fiscal year . 



(3) In reporting the requirements of the "Best Efforts 
Questionnaire" to FBIHQ, a letterhead memorandum is to be 
submitted to the CIU, FBIHQ, by COB October 15 of each fiscal year 
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34-9 FUNDING AND DIRECT SERVICES AVAILABLE TO FEDERAL CRIME 
VICTIMS 

(1) The FBI does not have the authority to provide 
financial compensation to crime victims but there are various state 
and local, agencies that provide financial and direct assistance to 
federal crime victims. These services are provided to victims and 
witnesses by state and local agencies that receive federal crime 
victim grants from the OVC. The FBI should refer victims and 
witnesses to all available services. Authority to provide 
compensation for victims and witnesses rests with each 

state's compensation board, rather than with the law enforcement 
departments. 

(2) After the victim has reviewed the brochure and if 
he/she requests services, the VWC or the Case Agent shall refer the 
victim to the place where he/she may receive emergency medical and/or 
social services; inform the victim of compensation for which the • 
victim may be entitled under this or any other applicable law; and 
inform the victim of the manner in which such relief may be obtained. 
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34-9.1 State Compensation Programs 

(D Crime victims compensation programs, administered by 
the states, provide reimbursement of out-of-pocket expenses to victims 
and survivors of victims of violent crime. Payments are made for 
medical expenses, including expenses for mental health counseling and 
-^^'-^°-£^ a 6es_^Ur!buy^Jo^ 



»$" 



; — — — ~ — =— -— — =— tr--j.~ - — — - ^!j»*ii »iim iwiciiii 

expenses attributable to a death resulting from a compensable crime. 
Some other compensable expenses include the replacement of eyeglasses 
or other corrective lenses, dental services and devices, and 
prosthetic devices. 

(2) The Information Resources Division, Executive 
Agencies, Personnel and Administrative Support Unit, at FBIHQ has 
signed a Memorandum of Understanding (MOU) regarding the release of 
information to state compensation boards. The purpose of this MOU is 
to expedite the release of information to state compensation boards 
regarding the verification of an incident reported to the FBI by a 
crime victim. Each field office has a copy of the MOU and the All 
SACs airtel related to this MOU. 
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(3) Each state has its own procedures for crime victim 
compensation including the determination of maximum award 
amounts, criteria for approving claims, and the application process. 



MANUAL." 
contact 
refer th 
the neee 
Compensa 
pamphlet 



(4) Each VWC should have a "VICTIM/WITNESS RESOURCE 
Included in this manual is a complete listing of the 
person(s) for each state compensation board. The VWC shall 
e victim to the contact person who can provide him/her with 
ssary information needed to apply for compensation, 
tion information should also be listed on the back of each 
(Entitled Information for Victims and Witnesses of Crime) 
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The Victims of Crime Act of 1984 (VOCA) established the 
Crtme Victims Fund (Fund) in the U.S. Treasury to provide financial 
assistance to victim compensation and victim assistance programs. 
Fines and penalties from convicted federal defendants - not 
taxpayers - provide the money for the Fund. The major 
function of the Fund is to make services available to victims of 
federal crime by providing grants to direct service providers in 
addition to state compensation boards. 
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| 34-10 THREAT ASSESSMENT 

(1) Consistent with the provisions of Title 18, USC, 
Sections 3521-3528, the responsible official shall make the necessary 
and appropriate arrangements to enable victims and witnesses to 
receive reasonable protection against threat, harm, and intimidation 
from a suspected offender and persons acting in concert with or at the 
behest of a suspected offender. 

(2) Coordination of services for victims/witnesses 
requesting protection from intimidation should be coordinated through 
the field office VWC. 

(3) If the victim or witness desires formal protection in 
the Witness Security Program (WSP) , the field office VWC or case Agent 
should contact the Witness Security Program Coordinator in his/her 
field office who will then take 'appropriate actions. 
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34-11 



SrZ^fv INCIDENTS 0F CHILD ABUSE ON FEDERAL LAND AND 
FEDERALLY OPERATED OR FEDERALLY CONTRACTED FACILITIES 



(1) The VCAA was signed into law as Title II of the CCA 

IVll rr t£ng f tHiS le * £ * lati -. Congress found that ncidents 
of suspected or actual child abuse on federal land, federally operated 
or federally contracted facilities was grossly underreporUd anS this 

r^rtXrUw 6 " ° ften ^ CeSUlt ° f the laCk ° f * "ryred-l 
-^—^■i^-fimUSBJStJ tl^-AciJs_to_re fl uire_persons 



worn ng on federal la^dT^aTlyo ^^rt^I^*^- 

llltl ill t0 / ep0rt °»*P*<*** or actual child abuse to the appropriate 
local law enforcement agency or local child protective service agency! 

«r. v .«f (3> Fa£1 " re t0 file fiuch a f eport or inhibiting or 
preventing someone from filing a report results in criminal penalties. 

iS* ► ( ? t ^" au re 8 ula tions regarding the reporting of 
incidents of chid abuse in Indian Country is contained in the MIOG, 
Part I, Section 198-6 through 198-6.9. 
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I 34-11.1 Mandatory Reporting by Federal Investigators 

in t-l,. -J - A % laW e " force,Dent officers, FBI Agents are included 
in the category of "mandated reporters" as identified in the VCAA 
Therefore, any Agent, working on federal land or in fe^raUy 
operated or contracted facilities, where children are cared for or 
reside, who has knowledge or reasonable suspicion that a child has 
been or is going to be abused, must immediately notify the local child 
protective services agency or law enforcement agency of that 
knowledge or suspicion. Compliance with this law is a responsibility 
placed upon each Agent INDIVIDl/ALLY and not on the FBI as an agency. 

BrB .„.. a (2) ^ local law enforcement agency or local child 

luslltlZ ,l"Z 1C t ag T y that reCeiVeS notification of child abuse or 
suspected child abuse from a mandated reporter working on federal land 
or in federally operated or contracted facilities or other individual 
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must immediately initiate an investigation and take steps to secure 
the safety and well being of the child (children) involved. This 
includes the FBI when it has primary investigative responsibility. 

(3) When a local law enforcement agency or local child 
protective services agency receives notification from any person 
alleging child abuse on federal land or federally operated or 
contracted facilities outside that agency's primary investigative 
jurisdiction, the receiving agency must immediately notify the other 
primary agency and submit a written report within 36 hours as set 
forth below. 
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(4) Within 36 hours after receiving notification 
described above, the receiving agency will prepare a written 
report that shall include, if available: 

(a) the name, address, age and sex of child that is 
the subject of the report; 

I (b) the grade and the school in which the child is 

currently enrolled; 

(c) the name and address of the child's parents or 
other person responsible for the child's care; 

(d) the name and address of the alleged offender; 

(e) the name and address of the person who made the 
report to the agency; 

( f ) a brief narrative as to the nature and extent of 
the child's injuries, including any previously known or suspected 
abuse of the child or the child's siblings and the suspected date of 
the abuse; and 

(g) any other information the agency or the person 
who made the report to the agency believes to be important to the 
investigation and disposition of the alleged abuse. 

(5) Upon completion of their investigation of any 
allegation of abuse made, to a local law enforcement agency or local 
child protective services agency, sucli agency shall prepare a Yinal . 
written report on such allegation. 

The identity of any person making an initial notification described 
above shall not be disclosed without consent of that individual to any 
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.34-11.2 Standard Reporting Form (See MIOG, Part II, 34-11.4.) 

In every federally operated (or contracted) facility 
- a -nd_on^^fj5d^rjaJLJjmj^^ reporting form, with 



instructions, shall be disseminated to all mandated reporter Tr^pTT 
Use of this form shall be encouraged, but its use shall not take the 
place of the immediate making of oral reports, telephonically or 
otherwise, when circumstances dictate. 
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34-11.3 Penalty 



"SH. 









(1) Failure to report suspected child abuse may result in 

a Class B Misdemeanor. Therefore, each Agent must ensure adherence to 
the statute. The VCAA also states that a "mandated reporter" who 
makes a report based upon his/her reasonable belief and which is made 
in good faith, will be immune from civil or criminal liability for 
making the report. 

(2) Since violation of this statute ia a misdemeanor, 

SACs (or their designees) shall inform each Agent of his/her statutory 
obligation to report and assist in the identification of abused 
children and discuss the prosecutive merit of each case with the U. S ' 
Attorney before actively investigating complaints. 
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34-11.4 Designated Agency to Receive Reports of Child Abuse 

(1) The FBI is defined as a "local law enforcement 
agency". only when it has "primary responsibility for the investigation 
of an instance of alleged child abuse" on federal land, or federally 
owned or contracted facilities and must immediately initiate an 
investigation. and take immediate steps to secure the safety and well 
being of the child (children) involved. 



(2) When the FBI receives notification from any person 
_alleging_child_abus.e_on_federaL^ 

facilities, including Indian country, and the FBI does not have 
primary investigative jurisdiction as defined by the law, the FBI must 
immediately notify the appropriate agency and submit a report within 
36 hours as set forth in 34-11.2. 
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34-11.5 Privacy Protection of Child Witnesses and Child 
Victims 



Stringent procedures for protecting the privacy of a child 
victim or witness and assuring the confidentiality of information 
received concerning a child victim or witness, include inter alia: 
filing under seal all documents which disclose the names of or 
identifying information concerning child victims and child witnesses, 
and redacting such names and identifying information from any publicly 
disclosed documents. 
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34-12 TRAINING 



(2). The VWA Staff at FBIHQ shall be res ponsible for 



(2) Joint initial investigative interviews of child 
victims by law enforcement, health, and social serviceagencies; 

(3) A requirement that, to the extent practicable, the 
same agency representative who conducts an initialinterview, 
conduct all subsequent interviews; and 

(4) Coordination of each step of the investigation 
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(1) It shall be mandatory for the Training Division to 
provide training to all presently employed and new investigators, 

concerning their responsibilities in carrying out the provisions of H^ 

the Victim and Witness Protection Act of 1982, Victims Rights and **C 

Restitution Act of 1990, and the Victims of Child Abuse Act of 1990 ^' 

and to provide written instructions to ensure that these laws are ' ^ 

implemented. . s %" 



coordinating a training curriculum, in conjunction with the Training 

Division at the FBI Academy, Quantico, with respect to the assistance 

of victims of and witnesses to federal crime, including child »« 

witnesses and victims of child abuse. . : ,'J0 
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34-12.1 The Multidisciplinary Team Approach in Child Abuse -1^ 

Cases ;V ! 

-■■■'%< 
Each SAC, in coordination with the USAOs, shall provide Ip 

training to all Agents on multidisciplinary methods of ' "' 

interviewing victims of child abuse and child sexual abuse. The 

responsible official may follow the criteria, set out in Section 

212(b), Subtitle A, Victims of Child Abuse Act (VCAA) , recommending w 

that state grant recipients develop and implement multidisciplinary 

child abuse investigation programs, including: 

(1) A written agreement between local law enforcement, 
social service, health, and other related agencies tocoordinate child 
abuse investigations; 
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process to minimize the number of the interviews that a child 
victim must attend. 
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Where multidisciplinary teams are not yet formally established 
federal investigators should coordinatewith existing child protective 
service agencies to reasonably protect children at risk from further 
abuse. Compliance with this training requirement shall be included in 
the agency's annual "Best Efforts Report." 
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34-13 



RELEVANT EXCERPTS OF THE ATTORNEY GENERAL GUIDELINES ON 
VICTIM AND WITNESS ASSISTANCE 



(1) The following are excerpts relevant to the duties of 
the FBI regarding VWA as taken from the Attorney General Guidelines 
for Victim and Witness Assistance. A notation will designate what 
sections have been skipped. 

(2) The Attorney General Guidelines should be interpreted 
in a positive manner. The advice of FBIHQ should be obtained before 
the services to victims or witnesses are refused or discontinued if 
there are any questions regarding the interpretation of these 
guidelines. 

(3) When submitting an inquiry regarding the 
interpretation of the guidelines or request that the Department of 
Justice be consulted, provide the necessary information from which a 
judgment can be made regarding the victim or witness. 



ARTICLE I. GENERAL CONSIDERATIONS 
A. Statement of Purpose 



I 



The purpose of these guidelines is to establish procedures 
to be followed by the federal criminal Justice system in responding to 
the needs of crime victims and witnesses. These guidelines combine 
the requirements of the Victim and Witness Protection Act of 1982 
(VWPA), PL 97-291 (October 12, 1982), and the victims rights 
statutes contained in the Crime Control Act of 1990, PL 101-647 
(November 29, 1990), "the Act." Consistent with the like purposes of 
these statutes, the present Guidelines shall provide definitive 
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guidance on implementation of the 1990 Act as well as continued 
guidance on the protection of witnesses under the VwPA anj shaH 
(iZlJ? a ,V ngle : *•"«"• ^r the Department of Justin 
Unvestigative, prosecutorial, and correctional) agencies in the 
treatment and protection of victims and witnesses ^federal crimes. 

r,-A i. T 5 6Se Guideline * supersede the 1983 Attorney General 
Guidelines for Victim and Witness Assistance. General 
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B. Background 



I 




-I h ^?.y^^d_WUn^s_Pr^tectio i ^ was enacted 



u ,-h„„„„» . ... . "7 C ~"- une necessary role of crime victims and 

resources to ass st victims and witnesses of crime withou" infringing 

leg sLt on for IT? "f f °f defendants 5 «* to provide a mo^f "or 
legislation for state and local governments." 

th« „**• Enactne "! of the Cri "»e Control Act of 1990 demonstrates 

the continuing national concern for innocent victims of all crimes and 

wUnes'sL LY ie : that - the needS 3nd interests of vi ^i»s anS 
SSr»I? • ?• r ««ived appropriate consideration in the federal 
criminal justice system under the VWPA. The victims* rights 

xZilll™ f S U i^ mandat<S th3t ° f ficiaU of th « Depfrtment of 
IZlJ*' ?• 0t " f6deraX a « enci « s ' ^gaged in the detection? 

ensure1hat°vlct- '"l™*: 1 " ° f cri>w ' nake their b *** «"°" * to 

th! v? J ^ i- "!• Cri ° e a " treated with ^irness and respect for 
the victim's dignity and privacy. p " ror 

„,.„, . Th %i"? Vi «=tims' Rights and Restitution Act (VRRA) 
creates, m effect, a federal Victims of Crime Bill of Rights and 
J2i»!'c"« C rt^ f al1 hencef0rth "e. available to vfctLs of 
of "tness""- 'however 't- ?' Specificall y a <""« the treatment 
lUT^l* ■ ' f 0Wever ' xt reinforces and augments the VWPA in 
acknowledging the necessary role of witnesses in the criminal justice 
process and in ensuring their fair treatment by responsible officials. 

The 1990 Victims of Child Abuse Act (VCAA) contains 

Si'w jStSrsrs-fj th : criminal code -"^Wt^r s^,* . £ 

child victims and child witnesses by the federal criminal 
justice system. The 1990 VCAA provides, inter alia, a mandatory 
requirement for certain professionals working on federal land or in a 
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" . ... , . us ' the 1990 victims' rights statutes, i.e., Title V, ' ^ 
Victims Rights and Restitution Act, and Title II, Subtitles D and E, 
Victims of Child Abuse Act, together with the Victim and Witness 
Protection Act of 1982, provide the federal criminal justice system 
with enhanced statutory responsibility to assist and protect crime 
victims and witnesses in a comprehensive and uniform manner. 

I C. Application 

.,:, These Guidelines apply to those components of the 
Department of Justice engaged in the detection, investigation or 
_P.roAecu.tion_p^al^ 

incarceration of federal defendants. They are intended to ~a7ply in ~ 
all cases in which individual victims are adversely affected by 
criminal conduct or in which witnesses provide information regarding 
criminal activity. While special attention shall be paid to victims 
of serious, violent crime, ALL.victims and witnesses of federal crime 
who have suffered physical, financial, or emotional trauma shall 
receive the assistance and protection to which they are entitled under 
the law. 

It should be noted that because of the nature of 
federal criminal cases it will often be difficult to identify the 
victims of the offense and, in many cases, there will be multiple 
victims. Sound judgment will, therefore, be required to make 
appropriate decisions as to the range of victim services and 
assistance given. However, Department of Justice personnel should err 
on the side of providing rather than withholding assistance. For 
example, m a large-scale federal fraud scheme case, it may be 
possible to extend victim services and assistance to a representative 
of the many victims of the fraud. 

D. Definitions 

For purposes of these Guidelines — 

(!) Tb -e term "victim" means a person that has suffered 
direct or threatened, physical, emotional, or pecuniary harm as a 
result of the commission of a crime, including: ■■»..' 

(») in the case of a victim that is an institutional " 
entity, an authorized representative of the entity; and 

(b) in the case of a victim who is under 18 years of 
age, incompetent, incapacitated, or deceased, one of the following (in 
order of preference): a spouse; a legal guardian; a parent; a child; 
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a sibling; another family member; or another person designated by the 
court • ,s - ' f * : „. •■ . ° ' , 

w '., -''■*,,.. . ' ' •" ■ ■• . 

.'*•*•'' ( J) F»de«l departments and state and local agencies, as 
entities, shall not be considered "victims" for the purposes of 
Articles III and IV of these Guidelines. 

(3) The term "witness" means a person who has information 
or evidence concerning a crime and provides information regarding 
his/her knowledge to a law enforcement agency. Where the witness is a 
minor, the term "witness" includes an appropriate family member or 
-legal_guardian The_term_iVitness^_does_no.t_include a„defense witness 
or an individual involved in the crime as a perpetrator or accomplice." 

iqq<»> ^ Th ° term " serious crime" (as used in the VWPA of 
1982; means a criminal offense that involves personal violence, 
attempted or threatened personal violence, or significant property 

X OS s * 

a c- „ ( ?} . The term " f inan cial" or "pecuniary" harm shall not be *' 
defined or limited by a dollar amount, thus the degree of assistance 
must be determined on a case-by-case basis. For example, since 
victims, means vary, that which constitutes a minimal financial loss 
for one might represent a devastating loss for another. 

SKIP D(6), p. 3. 

r 10 <. °) The term " chil d" neans a person who is under the age 
of 18, who is alleged to be — . . . * 

(a) a victim of a crime of physical abuse, sexual 
abuse, or exploitation; or 
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person. 



(b) a witness to a crime committed against another 







(8) The term "child abuse" means the physical or mental 
l u 3 ^7' " xual ^use or exploitation, or negligent treatment of a 
child. The term "child abuse" does not include, however, discipline 
administered by a parent or legal guardian to his or her child 
provided it is reasonable in manner and moderate in degree and 
otherwise does not constitute cruelty. 

(9) The term "physical injury" includes lacerations, 
fractured bones, burns, internal injuries, severe bruising, or serious 
bodily harm. 
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(10)The term "mental injury" means harm to a child's 
psychological or intellectual functioning which may be exhibited by 
severe anxiety, depression, withdrawal or outward aggressive 
behavior, or a combination of those behaviors, which may be 
demonstrated by a change in behavior, emotional response, or 
cognition. . 



.-. t '*'** : i,!-'i- 







(ll)The term "sexual abuse" includes the employment, 
use, persuasion, inducement, enticement, or coercion of a child to 
engage in, or assist another person to engage in, sexually 
ex plicit conduct; or the rape, molestation, prostitut ion, or other 
form of sexual exploitation of children; or incest wiTh^ihfldFenT - 






(12) The term "sexually explicit conduct" means actual or 
simulated-- (A) sexual intercourse, including sexual contact in the 
manner of genital-genital, oral-genital, anal-genital, or oral-anal 
contact, whether between persons of the same or of opposite sex; 
sexual contact means the intentional touching, either directly or 
through clothing, of the genitalia, anus, groin, breast, inner thigh, 
or buttocks of any person with an intent to abuse, humiliate, harass, 
degrade, or arouse or gratify sexual desire of any person; (B) 
bestiality; (C) masturbation; (D) lascivious exhibition of the 
genitals or pubic area of a person or animal; or (E) sadistic or 
masochistic abuse. 

(13) The terra "exploitation" means child pornography or 
child prostitution. 

(14)The term "negligent treatment" means the failure to 
provide, for reasons other than poverty, adequate food, clothing, 
shelter, or medical care so as to seriously endanger the physical 
health of a child. 

(15)The term "multidisciplinary child abuse team" means a 
professional unit composed of representatives from health, social 
service, law enforcement, and legal service agencies to coordinate the 
assistance needed to handle cases of child abuse. 

| ARTICLE II. CRIME VICTIMS' BILL OF RIGHTS 

| A. Victims' Rights (Sec. 502(a)) 
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BEST EFFORTS TO ACCORD RIGHTS. The Act provides that 
officers and employees of the Department of Justice and other 
departments and agencies of the United States engaged in the 
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detection, investigation, or prosecution of crime shall make their- 
best efforts to see that victims of crime are accorded the rights 
described in the Act. 

|. BILL OF RIGHTS OF CRIME VICTIMS (Sec. 502(b)) 

| A crime victim has the following rights: 

(1) The right to be treated with fairness and with 
| respect for the victim's dignity and privacy. 

-I?) The ri ght to be reasonabl y protected from the accused 



offender. 
I (3) The right to be notified of court proceedings. 

(4) The right to be present at all public court 
proceedings related to the offense, unless the court determines that 
testimony by the victim would be materially affected if the victim . 
heard other testimony at trial. 

(5) The right to confer with attorney for the Government 
in the case. 
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| (6) The right to restitution. 

(7) The right to information about the conviction, 
sentencing, imprisonment, and release of the offender. 

B. Mandatory Reporting of "Best Efforts" 

In the spirit of full compliance with these Guidelines, 
each United States Attorney, Department Chief of Litigation, FBI 
Special Agent in Charge (through the Director, FBI) as well as each 
responsible official of the Department's investigating field offices 
and correctional facilities, shall report annually to the Attorney 
General, through the Director, Office for Victims of Crime, by 
November 1st of each year, on the "Best Efforts" they have made during 
the preceding fiscal year, in ensuring that victims of crime are 
accorded the rights set out in the Act. 

•• The res P oi,sible official, in preparing the annual "Best 
Efforts Report, shall include an account of practices and procedures 
which have been adopted (and are in actual use in each of their 
respective offices), during the preceding fiscal year, to provide the 
services to victims mandated under the Act. 
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C. Performance Appraisal 



oerf rm a «J h ; At * orn ? v <? eneral strongly recommends that the annual 
performance appraisal of each federal law enforcement officer, 

staff o? a thoL P fl r ° SeC - t0 ^- an ? co " ections •«*«' (and appropriate 
staff of those agencies) include, as a required activity, 

implementation of and compliance with the victims' rights and victims 

and witnesses services provisions set forth in these Guidelines. 

"Bi.^Effo^s " i^ir "* endation shouid be inciuded in the annUal . 



ARTICLE III. SERVICES TO VICTIMS AND WITNESSES^ 




! 




t -• *** * general rule > for Purposes of this Article, 
Investigative components will be responsible for C(l), (2), and (3), 
DO), (2), (3) (a) (b), (5) and (6); prosecutorial components 
ToLLS " Sp0 "f^ le for DC3)(c)-(h), and (4); and correctional 
components will be responsible for D(7) and (8). 

Accordingly, at each stage in the performance of 
D^rr^r «! '"J!*"" 1 °5 responsibility from one component of the 
Department of Justice to the next must, of necessity, include 
a sharing of information (in many cases PRIOR to the actual turning 

.°e"ie« P :«°!;; * "J y i* ? th " Way ' gapS £ ° -""«■«« 2d otLr 
fronted r r in f ted and . cri " e vi <=tims receive uniform rather than 
fragmented treatment, starting from the initial investigation and 
continuing throughout their entire involvement with the federal 
criminal justice system. 

A. Designation of Responsible Officials (Sec. 503(a)) 

„ a . . f . For purposes of these Guidelines, the Attorney General 
makes the following designations of persons who will be responsible 
for identifying the victims of crime and performing the services 
described in the VRRA, section 503(c), at each stafe of a criminal 
case, • - 

INVESTIGATION 

*„, ► J° r " 8 !" Under inve =tigation, and in which no charges 
have yet been instituted, application of this section will be the 
responsibility of the following officials: 

,.' J 5 1 * with : r «pect to offenses under investigation bv 

the Federal Bureau of Investigation, the responsible official shall be 
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the Special Agent in Charge of the division having primary ; 

responsibility for conducting the investigation; 

SKIP A. Investigation (2)-(4), Prosecution, Custodial and Corrections, 
P» '~o. ' 
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B. Delegation and Coordination. 

In order to implement the requirements of the Act, there 
must be one individual who shall be. designated specifically to carry 
out victim-witness services in each Department of Justice 
-^sjLigaJ^f^L^^ U. s . Attorne y's 

Office, and Justice Department litigating division. " This~person shalT 
be delegated authority by the responsible official to carry out the 
activities enumerated in these Guidelines. 

11 is incumbent upon responsible officials to ensure that 
all components of the Department of Justice cooperate with each other 
t- ^ e ™ axinium extent P<>«ible in providing victims the services to 
which they are legally entitled. In many instances where certain 
duties and responsibilities overlap, the responsible officials must 
take all steps necessary to require coordination and interagency 
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Moreover, all components shall work with appropriate 
components of other federal agencies that investigate and prosecute 
violations of federal law to assist them in providing these services 
to victims; and shall coordinate their victim-witness service efforts 
with state and local law enforcement officials, including tribal 
police officials in Indian Country and victim assistance and 
compensation service providers. 



C. Identification of Victims (Sec. 503 (b)) 

i. ^ " At the earliest opportunity after the detection of a 
crime, the responsible official of the investigative agency shall 
make reasonable and diligent efforts to: 




I (1) identify the victims of a crime; 

(2) inform the victims of their right to receive, on 
request, the services described in the Act; and 

(3) inform each victim of the name, title, business 
address, and telephone number of the responsible official to whom such 
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■ ,■ Within the meaning of this Article, "the earliest 

opportunity" means one that will not interfere with an investigation 

enfo™L reSP °-! ^ ° f£ > Cial £n the' performance of otheAaw 
enforcement responsibilities. 

In order to comply with the above informational 

llT.lir^l 8 ' l l i8 " c ? mmended that a printed brochure, containing 
general information, brief description of rights and available 
J"!! 6 "" wel * "the names and phone numbers of key officials and 
"£■?■ T ^ tw ?rf M t ^^^^'-^*iv.en_tp^ict.ims_as.j ! pon^s identified. 
Whenever possible, personal contact should be initiated wilh" vTcTim^ 

»£I»f Fff°V" I * f ecOD »«? nda tion should be included in the annual 
cost Efforts" Report. 

D. Description of Services (Sec. 503 (c)) 

- • » n W " At * he earliest opportunity after detection of a 
makTr efl ^! e "•> ,0B J l "« •««»«! of the investigative agency shall 
make reasonable and diligent efforts to inform crime victims 
concerning: 

morf ,v a t a, (a> - ? he Place Where the vict io may receive emergency 
medical and/or social services; 






■y 

-- Mi-' 






«„., k 4- „, Z^, compensation or restitution for which the victim 

in whLrf, 1 ,^ ?? V thl ! ° r *"? otha 5 *PP licabl * !••; and the manner 
in which such relief may be obtained, (see article VI, "Restitution"- 
see also Appendix, under "Compensation");/ and ' 

... _ (c) the availability of public and private programs 
which provide counseling, treatment and other support to the victim. 

. ' •' -\" , -.. 

(d) The "sponsible official shall, to the extent 
deemed necessary and feasible, assist the victim in contacting the 
specific person or office which will provide the above services. 

c ' -• ,2? ,^! n8istent with the provisions of Tit'le 18, USC, 
Sections 3521-3528, the responsible official shall make the necessary 
and appropriate arrangements to enable victims and witnesses to 
receive reasonable protection against threat, harm and intimidation 

hlhl? S J Spected f f «" d " and persons acting in concert with or at the 
behest of a suspected offender. 
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Moreover, information on the prohibition against 
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b^f^ ", 8 ^ h f ra " n,ent and the re » edi « therefor shall routinely 
be made available to victims and witnesses. The responsible official 

Jav Ik th W3 " anted » advi " th * ""Po^nt of the Jusfice Departmen 

S^wL % ■ f CenJent . reSP ° n8ibilities (e *8-' the U -S- Marshals . 
Service) of instances involving intimidation or harassment of any 
victim^ or witness. y 

fTF f-K. „^ DUri "! thC investi 8 ati <>n and prosecution of a crime, 
UF the victim or witness has provided a current address or telephone 
number) a responsible official shall make diligent and reasonable 
efforts to consult with and provide the victim or witness "the 
.earliest possible notj_c.e^^oncerningj 
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„.„. ., . (a) * h ? * tatus of investigation of the crime, to the 
extent it is appropriate and will not interfere with the 
:;;:Sl ti0n ' deluding the decision not to seek an indictment or 
otherwise commence a prosecution; 

(b) the arrest of a suspected offender; 
SKIP D(3) c-h & D(4), p. 10-11. 

.„„,.« • f (5) ^ *i l tiffleS ' the res P°neible official shall take 
b^^;?^ °1 U ensure . that an V Property of a victim that is 
being held as evidence is maintained in good condition and returned to 
the victim as soon as it is no longer needed for evidentiary purposes 

officii ^KJ^I D ^P"tment of Justice-designated responsible 
nv : t L J » of another department or agency that conducts an, 
investigation of a sexual assault shall pay, either directly or by 
reimbursement of payment by the victim, the cost of a physical 
evidence! " * Victim and the cost » of "Aerials used to obtain 

SKIP D(7)-(8), p. 11. 
ARTICLE IV. OTHER SERVICES 

In addition to the services described above, other ' 

a hT!xti a rV"'^ anCe Bh e °^ d be extended to victim, and witnesses, to 
the extent feasible, as follows: 















.....a 

-. ssSt 



\.\-At 









.i>a"' 



"V«fe 

•"El. 



w 






#> 

£• 



>yi. 



Sf-^'v? 




d.f™,.. ^ k/- !■ P r08ecut0 « shal l resist attempts by the 
J'S,! ?" / 1SCOVer y of the " a *«. addresses and phone numbers 
of victims and witnesses. . Responsible officials and employees should 



Sensitive 
PRINTED: 02/18/98 



V* 



, 7 '-if. ' 



if 






•"• : ~^**Nlf#C 




Sensitive 



Manual of Investigative Operations and Guidelines 
Part II ., "> ■■:«;'/l-' :;^'\;;, ■. ..- •■•• -•.:.<> •• ... 



••' Wp 



PAGE 34 - 28 , 



also avoid disclosing the names, addresses and phone numbers of 
victims and witnesses. 



.VciiS 





In cases involving a witness who has been promised 
anonymity or who operated in an undercover capacity, federal 
prosecutors should consult with such witness, and the primary law 
enforcement agency involved in the case, before disclosing the 
identity, address, or location of any such witness, and shall not make 
such disclosure without the consent of the witness and the law ' 
enforcement agency. 

Jb — ypon_xe_gugs_t by a victim or witness, the 



responsible official should" assist in notifying: 



«. • ." ?" emplover of the victim or witness if cooperation in 
the investigation or prosecution causes his/her absence from work; and 

- the creditors of the victim or witness, where 
appropriate, if the crime or cooperation in its investigation or 
prosecution affects his/her ability to make timely payments. 

C. Responsible officials should establish programs 
to assist Department of Justice employees who are victims of crime. 

D. Victims and witnesses should be provided 
information or assistance with respect to transportation, parking, 
translator services and related services. 

| SKIP ARTICLE V. Victim Impact Statement, p. 12-13. 

| SKIP ARTICLE VI. Restitution, p. 13-14. 

| ARTICLE VII, CHILD VICTIMS' AND CHILD WITNESSES' RIGHTS 

I A. Statement of Purpose 

The Victims of Child Abuse Act of 1990 (VCAA) was enacted 
in response to the alarming increase of suspected child abuse cases 
made each year (over 2 million reports each year). In such cases, 
because the investigation and prosecution of child abuse is extremely' 
complex, too often the system had not paid sufficient attention to the' 

?r?%r ?'!5^V f , the Child vUtim - thus aggravating the trauma ~ 
that the child had already experienced. Therefore, in order to 
address this nationwide emergency, the 1990 VCAA provides, inter alia, 
authorization for training and technical assistance to fudges 
attorneys and others involved in state and federal court child abuse 
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cases; requires certain professionals to report suspected cases of ": '• 
child abuse under federal jurisdiction; and amends the United States 
criminal code to ensure protection of children's rights in court and 
throughout the criminal justice system. ' •- » , .*- -. 

'■'.,.• The new iandnark procedures codify specific "rights" for 
children, never before legally recognized in federal court, and allow 
other important accommodations for children, including: the right of 
a child to have an adult attendant accompany the child during court 
testimony; allowance of the use of closed-circuit television and 
videotaped depositions of children, as alternatives to live, in-court 
-^At^yj^lrjngenljrocedures which protect a child witn g^* privacy 
as well as sanctions for violating such procedures; and a requirement ~ 
disallowing routine competency examinations, except upon written 
motion that compelling reasons exist, and ruling out age as a 
compelling reason. The goal of this Article is intended to assist 
every federal law enforcement officer, investigator, and prosecutor to 
take necessary and valid action to reduce the trauma to the child 
victim caused by the criminal justice system while at the same time 
increasing the successful prosecution of child abuse offenders. 

* -v. o,.,;? 1 ! 86 f u£delines «»»11 "rve to ensure full implementation 
of the VCAA by all investigative, prosecutorial and correctional 
components of the Department of Justice. 

I B. Investigation/Interviewing of Child Victims 

^.,, (1) Re P<>rting and Investigation of Suspected Cases of 

Child Abuse. 

(a) Pursuant to Sec. 226, Subtitle D, VCAA, 
certain professionals working on federal land, or in a federally 
operated or contracted facility, in which children are cared for or 
reside, are required to report suspected child abuse to an 
investigative agency designated to receive and investigate sucV " 
reports. The statute provides further that the Attorney General shaH 
designate the agency to receive and investigate these reports of 
suspected child abuse. By formal written agreement, the designated 
agency may be a nonfederal agency. '"'.'■ 

STANDARD REPORTING FORM. In every federally operated (or 
contracted) facility and on all federal lands, a standard written 
reporting form, with instructions, shall be disseminated to all 
mandated reporter groups. Use of this form shall be encouraged, but 
its use shall not take the place of the immediate making of oral 
reports, telephonically or otherwise, when circumstances dictate. - 
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REFERRAL TO LAW ENFORCEMENT. When such reports are 
received by social services or health care agencies, and involve * • 
allegations of sexual abuse, serious physical injury, or life- 
threatening neglect of a child, there shall be an immediate referral 
ot the report to a law. enforcement agency with authority to take 
emergency action to protect the child. All reports received shall be- 
promptly investigated, and whenever appropriate, investigations shall 
f«r C ™ f^* -T Uy b ? 1S ? enforce,nen t and social services personnel 
tor multidisciplinary team) with a view toward avoiding multiple - 
interviews with the child. In addition, it is important that a child 
?^^*'U^^™*J™^™L^_M^*ti<>n, if warranted, by a 
physician with expertise in forensic examinaU~onT."~~~~"^~ 



REPORTING IN INDIAN COUNTRY. As noted earlier, a 
separate statute, the Indian Child Protection and Family Violence 
Prevention Act, PL 101-630 (November 28, 1990), govern, reporting 
of child abuse in Indian Country. Pursuant to its provisions, certain 
professionals are required to report suspected child abuse to the 

local law enforcement agency." Title 18, USC, Section 1169. These 
terms are defined in section 1169 to mean the federal, state or tribal 
agency that has the primary responsibility for child protection or the 
investigation of child abuse within the portion of Indian Country 
involved. Furthermore, where the report indicates the victim or 
abuser is an Indian and a preliminary inquiry indicates a criminal 
violation has occurred, the local enforcement agency, if other than 
the Federal Bureau of Investigation, must report the occurrence 
immediately to the Federal Bureau of Investigation. 



(2) 



Mandatory Training for all Reporter Groups. 



Ca > The "sponsible official of the designated 
investigative agency shall provide to all mandated reporter 
groups of covered professionals training in their statutory obligation 
to report and in the identification of abused children. 

. (b) Sanctions for Failure to Report. The statute 
also provides that a covered professional who, while working on 
federal land or in a federally operated (or contracted) facility, in 
which children are cared for or reside, learns of facts that give 
reason to suspect that a child has suffered an incident of child 

tm!'lJ Ut n2 11 ; t J- r ' P S«i 8ha11 be gUUty ° £ a Cla " B »i»de°eanor. 
Title 18, USC, Section 2258. 
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(3) 



Interviewing Procedures to Reduce Trauma to Child. 
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• The responsible official, in coordination with the' U. S. • 
Attorney, shall provide training to all federal investigators on 
multidisciplinary methods of interviewing victims of child abuse arid 
sexual child abuse. The responsible official may follow the criteria, 
set out m Sec. 212(b), Subtitle A, : VCAA, recommended for state granj 
recipients to develop and implement' multidisciplinary child abuse 
investigation programs including: 

- a written agreement between local law enforcement, 
social service health, and other related agencies to coordinate chid 
abuse invest i gatij>n;__^ 




- joint initial investigative interviews of child victims 
by law enforcement, health, and social service agencies; 

- a requirement that, to the extent practicable, the same 
agency representative who conducts and initial interview conduct all 
subsequent interviews; and 

- coordination of each step of the investigation 

process to minimize the number of interviews that a child victim must 
attend. 

Where multidisciplinary teams are not yet formally 
established, federal investigators should coordinate with existing 
child protective service agencies to reasonably protect children at 
risk from further abuse. 

C. Prosecution of Child Abuse Cases 
SKIP C(l) - C(3), p. 17-21. 



Victims. 



(4) Privacy Protection of Child Witness 



es and Child 




Stringent procedures for protecting the privacy of a child 
victim or witness and ensuring the confidentiality of information 
received concerning a child victim or, witness, include inter alia- - - 
filing under seal all documents which disclose the names of or '*' 
identifying information concerning child victims and child witnesses, 
and redacting. such names and identifying information from any publicly 
disclosed documents. y 

SANCTIONS FOR VIOLATIONS OF RULE. REGARDING DISCLOSURE. 
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'■'''■*'" A knowing or intentional Violation 4 of the' privacy J ~ "V' 
protection accorded children pursuant to Section 3509 of Title 18 ; 
USC, x. a CRIMINAL CONTEMPT punishable by not more tha^ one year's.^ • 
imprisonment, or fine, or both. Title 18, USC, Section 403. 

| SKIP C (5) - C (11)', p. 22-24 

| WTNESy"RIGHTT DAT0RY T * AINING " " VICTn * J /CHILD VICTIMS' AND 

It shall be mandatory for all components of the Department 
-.of_Jus.tice_coyered_by_thes.e_Guidelines_to^proyide training to all 
presently employed and new attorneys, investigators, law ' «f o7ce~m«rfT~ 
and corrections officers concerning their responsibilities in carrying 
out the provisions of the Victim and Witness Protection Act of 1982, 
lousel^ UTn **? t«tion Act of 1990, and the Victims of Child 
Abuse Act of 1990, and to provide written instructions to appropriate 
subcomponents to ensure that these laws are implemented. 

•-», n J" f dd i tion « a11 training units conducted or supported by 
the Department of Justice shall develop programs which address victim 
assistance from the perspective of the personnel they train. These 
units inc ude the FBI Academy at Quantico, the Attorney General's 

Ad vLT y r InS ^ tUt r ^ th */ederal L™ Enforcement Training Center at 
Glynco, Georgia (through agreement with the U.S. Department of 
Treasury), and field training conducted by the FBI and DEA. 

Compliance with this training requirement shall be 
included in the agency's annual "Best Efforts" Report. 

,: ™ e ° f ? £ ? e for Victims of Crime shall be responsible for 

coordinating training programs, in conjunction with all components of ' 
the Department of Justice, with respect to victims and witnesses of " 
federal crime, including child witnesses and victims of child abuse'. 

| ARTICLE IX. NONLITIGABILITY ■ /^\^- -■ '■ '' '.. ..« ,, \. 

These Guidelines provide only internal Department of 

rTulTut T CB ' 1^ afe . n0t intended to. do not, and may not be ^ 
relied upon to create any rights, substantive or procedural 

^hf^T-i 6 , •* laW u b y, anv P erson in ^y matter civil or criminal. 

Si J.S J?- S " 0t be construed to cr..t«. enlarge, or imply > 

¥ Hi °t, ?J 1 ^ atlon to ™V victim, witness or other person for 
which the United State, or its employees could be held liable in 
damages. Nor are any limitations hereby placed on otherwise lawful 
litigative prerogatives of the Department of Justice. . 
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35-1 PURPOSE (See MIOG, Part I, 261-2.)' " • 

The purpose of this document is to establish uniform 
policy, responsibilities, and authorities for the implementation of 
the FBI's AutomBtcjUMl-grgg^fon and T elecommunications UDPTJ . 









Security Program. 



EFFECTIVE: 07/26/95 



35-2 ADPT SECURITY PROGRAM REFERENCES 

References to various regulations/laws applicable to the 
responsibilities of ADPT security-related personnel are located m 
Section 35-11. ' s. 



EFFECTIVE: 07/26/95 

35-3 DEFINITION OF TERMS " , . ' 

A glossary of terms is included as Section 35-12. 
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35-4 



SCOPE 



(1) The provisions of this policy appiy to all FBI 
personnel, all FBI ADPT systems, networks and support facilities, and 
to contractors acting, on behalf of the FBI. This policy also applies 
to any outside organizations, or their representatives, who are 
granted access to the FBI's ADPT system resources, such as other 
federal agencies and Joint Task Force members. 

(2) Microprocessors which are embedded in and dedicated 
strictly to pr oduction /proce ss control , such^s_labor^tcj-y^jiuipment ,_ 
are excepted. 



(3) The Information Systems Security Unit (ISSU) | 
Security Countermeasures Section, National Security Division, 
point-of-contact for questions . concerning this policy document 



is the 
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35-5 



BACKGROUND 




(1) The FBI develops a strategic plan each year which 
represents a commitment to carry out its mission with increasing 
effectiveness and efficiency. Information technology is an essential 
supporting element to the FBI's mission. Employees worldwide use ADPT 
systems for all facets of the Bureau's operations. These ADPT 
services also support law enforcement personnel and agencies outside 
the FBI. 

(2) In keeping with the FBI's mission, the goal of the 
FBI's ADPT security program is to establish and maintain effective 
security countermeasures to ensure the data confidentiality, 
integrity, and operational availability of all FBI ADPT systems that 
process, store, or transmit classified and sensitive but unclassified 
(hereafter referred to as sensitive) information. In essence, this 
policy applies to all FBI Systems, given that all Bureau information- 
is treated as at least sensitive. Moreover, Bureau information is not 
releasable except through the Freedom of Information/Privacy Acts 
(FOI/PA) process. 

(a) The Bureau's ADPT security program has been 
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designed to address the compromise of information processed in ADPT 
systems: (a) through penetration by hostile intelligence services 
and/or criminal elements; (b) by otherwise legitimate users who gain 
access to data or processes for which they are not authorized; or (c) 
as a result of inadequate security design, implementation, or 
operation. 

(b) The security countermeasures must. preserve the 
integrity of the information processing to ensure the data is 
accurate and relevant to achieve the FBI's investigative, law 
enforcement, and administrative support requirements. Inaccurate data 
could. lead to uninformed decisions and adversel y im pact the FBI's 
mission. 

(c) Required ADPT services should be available to 
authorized users within their operational time constraints. The 
security controls should also make the services unavailable to 
unauthorized users. 

(3) The scope of this policy document is ADPT security, 
including applicable life cycle security requirements. Several 
related programs should be taken into consideration when establishing 
and reviewing ADPT security requirements. Policies and procedures 
covering the related programs listed below are in this policy by 
reference (see Section 35-11) and should be obtained by contacting the 
appropriate program manager. 

(a) The Security Countermeasures Section 
(SCMS) , National Security Division (NSD) prescribes policy, 
procedures, and specifications for maintaining facility security for 
the FBI. The SCMS is also responsible for the FBI's information 
security, personnel security, and industrial security programs. 

(b) The FBI Central Office of Record (FBICOR) is 
responsible for setting policy for handling FBI communications 
security (COMSEC) materials and equipment and for establishing 
standards and procedures for granting authorization to FBI employees 
for access or use of those materials and equipment. The FBICOR also 
evaluates and approves cryptography and communications security 
measures to be used in ADPT systems. ■> 

(c) The Freedom of Information-Privacy Acts (FOIPA) 
Section, Information Resources Division sets policy for the FBI's 
FOIPA programs. 
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35-6 



GENERAL POLICY 



(1) Classified and sensitive information in FBI ADPT . 
systems must be safeguarded against unauthorized disclosure, 
modification, access, use, destruction, or delay in service. An FBI 
ADPT system is a telecommunications or automated information system 

_that_i»_owned,_lea*ed,_or_operated_by_or_on_behal£_of_the_FB.I._: „_ 

(2) The minimum security requirements identified in this 
policy shall be implemented to protect classified and sensitive 
information processed, stored, or transmitted by FBI ADPT systems and 
to protect FBI ADPT system resources. . 

(3) All ADPT systems processing, storing, or transmitting 
classified or sensitive information must be submitted for 
accreditation. Prior to processing, storing, or transmitting 
classified information, ADPT systems must be accredited. (See Section 
35HJ.2.) ADPT systems used to process, store, or transmit sensitive 
information must .be accredited as expeditiously as possible. 

(4) Connectivity is prohibited between internal FBI ADPT 
systems and all other systems or networks not covered under the FBI's 
management authority without approval of the appropriate FBI 
accrediting authority. 

(5) All FBI ADPT systems are for official business only. . 
System users have no expectation of privacy while utilizing these ^ r- 
resources. 
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(1) The Director, FBI, is responsible for the security of 



(c) Ensuring all ADPT system security plan 
documentation is maintained as defined, in Section 35-8.1.2. 



| 1. The Assistant Director, NSD, per Director of 

Central Intelligence Director (DCID) 1/16, has been designated as the 
accreditation authority for all systems processing, storing, or 
transmitting sensitive compartmented information (SCI). 

2. The Security Programs Manager (SPM) , SCMS, 
NSD, has been designated as the accreditation authority for all 
classified systems other than those processing, storing, or 
transmitting SCI, and for all sensitive systems. 

(2) The FBI's SPM, SCMS, NSD is responsible for the day- 
to-day administration of all security programs for the FBI, including 
the ADPT security program as follows: 

(a) Accrediting all classified systems other than 
those processing, storing, or transmitting SCI and all sensitive 
systems. 

(b) Implementing the FBI's ADPT security education, 
training, and awareness program on behalf of the Director, FBI. 

(c) Submitting security violation reports to the 
DSO, which include a damage assessment and any actions taken to 
prevent future violations. 

(3) The FBI's ADPT Security Officer, ISSU, SCMS, NSD, has 
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all ADPT systems under his purview and authorizes the implementation .^ 

of ADPT security countermeasures based on national policy and || 

guidance. The Director is also responsible for: 

(a) Certifying annually to the Department Security 
Officer (DSO) the adequacy of ADPT systems security in the FBI. 

(b) Ensuring a computer security education, 
...training ,__and. awarenes s_ program_is_es.tabli shed _in_.the_FBI . — _ — __ 









(d) Designating senior executive service personnel ^ 

accreditation authority for sensitive and classified computer systems J 

in the FBI. (See(3)(g).) ,J 
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been appointed by the Director, FBI, to facilitate the implementation 
of the FBI's ADPT security program, and has the following 
responsibilities: 

(a) Ensuring an operational ADPT security program is 
in place that asserts a centrally administered security policy. The 
ADPT security program must comply with the minimum security 
requirements defined in federal and /departmentwide mandates while 
preserving the flexibility of operations inherent in the Bureau s 
mission. 



_(b) Deve 1 op ing _and_p_r omulgat ing _ADPT_s.ecuri ty_ 



program policy for the FBI. interpreting policy relating to the FBI 
ADPT security functions and developing FBI unique guidance as 
required. Assisting FBI components and their representatives with 
their efforts to comply with these policies during the performance of 
their duties, by providing explanation or clarification of ADPT 
security-related questions that may have an impact on mission 
performance. 

, (c) Ensuring the appointment of Computer Systems 
Security Officers (CSSOs) for classified and sensitive FBI ADPT 
systems and providing the CSSOs with assistance. 

(d) Reviewing and approving acquisitions, in 
coordination with the CSSO and certifying that the appropriate ADPT 
security requirements defined in. this document are included in the 
specifications for the operation of an ADPT. installation facility, 
equipment, application system, or acquisition of ADPT hardware, 
software or related services. 

(e) Providing the CSSO with direction and guidance 
in defining and approving security requirements prior to the start of 
formal development of software. 

(f) Approving the security requirements prior to the 
start of formal development of software. 

(g) Ensuring accreditation packages are prepared for 
all ADPT systems under FBI authority that process, store, or transmit 
sensitive or classified information. The contents of an accreditation 
package are described in Section 35-8.2. 

1. Providing guidance on the scope and contents 
of the system security plans. 
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'■''"" 2. Reviewing system security plans prepared by T 
or on behalf of the System CSSOs. 

3. Preparing statements of residual risk and 
summary statements of compliance to complete each accreditation 
package. 

A. Submitting the accreditation package to the 
appropriate accreditation authority, as defined in Section 35-7(1) (d), 
for; accreditation. 



5.. Act ing_as_a_l iai son _to__the. DS0_.and_ the_ 



Department's Justice Management Division, Information Resources 
Management, Security Programs Manager (IRM-SPM) for all ADPT security 
matters. 

(h) Maintaining a record system containing the 
status of all accreditation documentation required in this policy 
document. 

(i) Administering the Bureau's security incident 
reporting program, on behalf of the SPM, to include establishing 
reporting criteria and coordinating with DOJ. 

(j) Coordinating the FBI's virus prevention program, 
to include: recommending virus prevention solutions; providing 
guidance in defining the requirements; and selecting the approach. 

(k) Conducting ADPT security policy compliance 
review and oversight activities, as discussed in Section 35-8.4. 

(1) Establishing and maintaining a program for 
conducting periodic facility risk analyses. 

(m) Establishing standards and guidance for the 
preparation of ADPT Installation Disaster and Continuity Plans. 
Conducting Bureauwide analyses and establishing and verifying Bureau 
strategies for business recovery and alternate processing. 
Coordinating the development of ADPT Installation Disaster and. 
Continuity Plans for FBI ADPT facilities. 

(n) Establishing standards and guidance for 
preparing End-User ADPT Contingency Plans. 

(o) Identifying areas or issues requiring ADPT 
security-related research and development effort. 
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(4) The head of each FBI Division (the Legal Attaches for 
each Legal Attache office) is responsible for all aspects of ADPT 
security under his/her jurisdiction. These responsibilities shall be. 
delegated to the Security Countermeasures Program Manager (SCMPMJ , as 
set forth in MIOG, Part I, Section 261. In addition, the sponsor^ 
each FBI ADPT system or major application shall ensure that a CSSO is 
appointed and that this appointment is documented in the system 
security plan; 

(5) The SCMPM shall assume the responsibility for the 
_implementation of ADPT s^curity_Jfor_^jdjjvisj^n^^ — The 

SCMPM may delegate the day-to-day implementation of the security 
responsibilities to other members of the division, but will remain the 
primary point-of-contact for ADPT security matters for the division. 
Responsibilities include: 

(a) Implementing ADPT security policy for ADPT 
resources that are under the direct operational responsibility of the 
division. 

(b) Enforcing the security policy and ADPT security 
countermeasures on all personnel who develop, manage, operate, 
maintain, or. use a division's ADPT resources. 

(c) Acting as the point-of-contact for security 
discussions with the FBI's ADPT Security Officer. 

(d) Ensuring ail employees under his/her 
jurisdiction receive computer security awareness training, as 
discussed in Section 35-8.3, following the guidance of the SPM. 
Promoting general operational ADPT security awareness within his/her 
organization. 

(e) Reporting immediately to the ADPT Security 
Officer any security incidents, such as any attempt to gain 
unauthorized access to information, virus infection, or other event 
affecting the systems security. 

(f) Ensuring End User ADPT Contingency Plans are 
developed, in accordance with Section 35-8.1.4, to ensure continued 
operations of essential functions within the division in the event 
that ADPT- support is interrupted. 

(g) Advising his/her management on implementation of 
provisions of this policy and applicable references. 
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(h) Ensuring all ADPT operations are conducted as 
accredited or that accreditation 'packages are prepared for operations 
not covered under existing accreditations. Accreditation is discussed 
in Section 35-8.2. 

(i) Maintaining a list of non-Bureau individuals 
with access to FBI systems and ensuring whenever a change in SAC -■ 
occurs, the incoming SAC reevaluates access granted to non-Bureau 
individuals. 

_( J ) Establish a prog ram that will check on a monthl y 



basis with squads hosting non-Bureau individuals the need for 
continued access to FBI systems. 

(6) A Computer Systems Security Officer (CSSO) shall be 
assigned for each FBI ADPT system. The CSSO is responsible for: 

(a) Ensuring' that new ADPT systems, whether acquired 
/T*^ or developed, are implemented with appropriate security features and 
I ■-' t meet the minimum requirements defined in this policy. 

1. Defining security requirements prior to 
starting formal development of a new ADPT. system, in coordination with 
the ADPT Security Officer. 

2. Reviewing acquisitions in coordination with 
the ADPT Security Officer, to ensure that the appropriate ADPT 
security requirements defined in this policy are included in the 
specifications of an ADPT installation facility, equipment, 
application system or acquisition of ADPT hardware, software or 
related services. 

3. Reviewing ADPT systems whenever changes 
occur, or at least every three years, to ensure changes have not 
occurred which affect the accreditation status. Conducting design 
reviews and system tests, and certifying the results recorded, for all 
new software and for existing software when significant modifications, 
are made. Section 35-8.2 discusses the types of changes that may 
affect the accreditation status of an ADPT system. 

4. Identifying and recommending to management 
security improvements for the ADPT system. 

5. Ensuring that configuration control 
mechanisms are used and maintained to protect the security-related 
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features of an ADPT system. 

(b) Preparing or overseeing the preparation of 
system security plans, as discussed in Section 35-8.1, and maintaining 
the documentation for each ADPT system under his/her assigned 
responsibility. 

(c) Coordinating the preparation and review of the 
system security plan with the ADPT Security Officer. The required 
steps in the approval' process are discussed in Section 35-8.1.1. 

: (d) Ensuring_the_distribution_of_standar.d_security 

procedures tailored for end users and operators of computer systems. 
Advising users of the security features and procedures used on the 
ADPT system. 



(g) Ensuring the review of audit trails and the 
thorough investigation of audit trail, discrepancies, in accordance 
with the review cycle defined in the system security plan. 



(7) The Section Chief of the Technical Operations 
Section, Information Resources Division is responsible for providing 
policy and guidance on Technical Surveillance Countermeasures (TSCM),, 
intrusion detection, and emanations security. 

(8) The Unit Chief of the|Network and Information Systems 
Support Unit (NISSU) , [Operations Management Section, Information 
Resources Division is responsible for providing policy and guidance on 
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(e) Coordinating with the appropriate CSSOs of other '£p 
systems and/or the FBI's ADPT Security Officer to ensure that planning • p 
for shared resources adequately addresses the security requirements ',:' 
that are relevant to each system. '' -.'&■' 

. '■■silt 

(f) Establishing access control criteria and . '-* 
administrative procedures, which are discussed in Section 35-9.4.1, '** 
consistent with Bureau policy, by which only authorized persons can .-.a 
gain access to the ADPT system. The criteria will identify authorized iffc 
users and identify responsibility for approving all access to the ' 1;|| : 
system. The procedures will identify the access control mechanisms ''-Sk 
and assign responsibility for administering the mechanisms. 
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(h) Reporting immediately to the Security '■'%«&} 

Countermeasures Program Manager any security incident, ' such as an .:2>§. 

attempt to gain unauthorized access to information, virus infection, 
or other event affecting the system's security. 
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the telecommunication-related construction of facilities to meet 
national standards ' for emanations security. 

(9) All persons who use, manage, operate, maintain, or 
develop classified or sensitive FBI ADPT systems must comply with this 
policy. 
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ADPT SYSTEMS SECURITY LIFE CYCLE 



(1) This section of the ADPT security policy documents 
activities relating to ADPT system acquisition and development. 
Whereas activities pertaining to system development and acquisition 
have traditionally been centrally conducted by Headquarters elements, 
the FBI's existing and planned ADPT system technology affords the 
opportunity for decentralized system development activities. It is 
imperative that all personnel are aware that, whereas this policy does 
not discourage systems development, it provides guidance to ensure 
that ADPT systems that are developed, acquired, and documented are in 
compliance with this policy. 

(2) The topics in this Section are applied as follows: 

' (a) Security Planning. Security planning activities 
are the responsibility of the sponsor of an ADPT system, the SCMPM, 
the CSSO, the ADPT Security Officer, and the SPM. These activities 
pertain to the development or acquisition of new FBI ADPT systems or 
modifications to existing systems. 

(b) Accreditation. Accreditation activities are the 
responsibility of the CSSO, the ADPT Security Officer, the SPM, and 
the accrediting authority. 

(c) Security Education, Training, and Awareness. 
These activities apply to all personnel who manage, use, or operate an 
FBI ADPT system, whether they are FBI employees or not. These 
activities are ongoing. 

(d) Security Oversight. Security oversight 
activities related to this policy are conducted by the ADPT Security 
Officer, the SCMPM, the CSSO, the SPM, and the Inspection Division. 
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35-8.1 Security Planning (See MIOG, Part II, 35-7.) 

Security planning activities support the accreditation of 
_a i l_c 1 as si f i ed_and_s ens i t iye_ADP.T_syst.ems.. T_ii,s_SA<Lt_Qll— 4es.cxibe s the .. 



activities and documentation required to achieve accreditation of a 
classified or sensitive FBI ADPT system and includes discussion of 
system security plans, risk management, contingency planning, 
certification, and system security procedures. The ADPT Security 
Officer should be consulted prior to the development or acquisition of 
a classified or sensitive system to establish the scope of the 
security-related activities and documentation required to achieve 
accreditation.. 




(4) The ADPT Security Officer shall approve the 
certification test plan and shall approve the results of the 
certification testing. 

(5) DOJ approval of the system security planning 
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35-8.1.1 Approvals (See MIOG, Part II, 35-7.) 

(1) Several steps in the security planning process iS 
require the CSSO to seek approvals to proceed with system planning 1££ v 

activities. . .,;^- 

■ <&& 

(2) Security requirements shall be defined and approved \;,V 
by the CSSO and the ADPT Security Officer prior to the start of A _^/ 
development or as part of the acquisition process. >' 

(3) The ADPT Security Officer shall approve the system ' .• \ 
design based on the security reviews prior to the start of system ;V:. 
development. .''£" 



.'Sit 

Sensitive , '/fiC? 

PRINTED: 02/18/98 ^ ; ^ 



■UJJl _'..-. ,„W^. 





'"■ *"*:*}« 

.v..- ■ , ;. . .. r -"•-.»".-.•;•" ..: ' ■'1^^ 

Section 35-8.2. . v4^ 

., iv ».• 

EFFECTIVE: 07/26/95 r 

35-8.1.2 System Security Plan (See MIOG, Part II, 35-7 & 35-8.2.) 
( 1) The ob j ective of s yste m se cur i ty p lanning is to 
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documentation is required prior to accreditation, as discussed in 
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improve protection of information and information processing H^ 

resources. The managers most directly affected by and interested in 4j| 

the information or processing capabilities must show that their ' *;{. 

information and processing capabilities are adequately protected from j^ 

loss, misuse, unauthorized access or modification, unavailability, or . -r^.^ 

undetected activities. '*%$? 

\ tfaj.j.- A - 

(2) The boundaries of the computer system must be clearly ~ ~" 
defined by the CSSO. When a network is used by only the FBI, the FBI 
ADPT Security Officer will determine the boundaries. Comparable ;' 
systems, operating in similar environments, may be included in a 

single system security plan. If additional security measures are _.., 

required for a particular operating environment, they will be added as 4v 

a supplement to the system security plan. While generic security ..-«.'/ 

plans lessen the administrative burden, CSSOs are responsible for '/■''$. 

ensuring the ADPT systems under their purview are operating in --^? 

accordance with the approved system security plan. Local area ^"' 

networks (LANs), hosts with terminals, groups of stand-alone personal 
computers, workstations, and office automation systems located in the 
same general area and performing the same general functions, require 
only one system security plan. 

(3) System security plan documentation is required for 
every classified and sensitive FBI ADPT system. The system security 
plan documents ADPT security requirements from development or 
acquisition, implementation, and operation to secure disposal. The 
system security plan is to be developed and maintained by the CSSO 
assigned to the ADPT system. The FBI ADPT Security Officer shall 
define the scope and contents of a system security plan for the FBI 
ADPT systems to ensure a standardized approach and to ensure 
compliance with applicable regulations. The system security plan 
should provide FBI management with sufficient' information to make an 
assessment about the security posture of the ADPT system. The 
components of a system security plan are: 
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N (a) A security plan which includes the information 
described in Office of Management and Budget (OMB) Bulletin 90-08 or 
its successor and is implemented in forma provided by DOJ or using the 
guidelines for preparing an FBI system security plan. Any questions 
should be directe«^^h^j|^DPT Security Officer (ADPTSO) , 
ISSU, SCMS, NSD, ■HH|^HH Rooin A282 » FBIHQ. The ADPTSO can 
assist in identifyTng^hemodeof operation of the system, assessing 
the threats and vulnerabilities, estimating the risk involved in the 
operation, and identifying specific critical countermeasures and/or 
safeguards. A system security plan form is available in WordPerfect 
_fr.om._the ADPTSO.. .._ ^ 

(b) Documented risk management actions pertaining to 
the ADPT system. Section 35-8.1.3 discusses the risk management 
process. 

(c) Certification statement that reflects the 
results of certification tests of the security features applicable to 
the system. Section 35-8.1.5 discusses the certification process. 

(d) Contingency plan which consists of an emergency 
response plan, backup operations plan, and post-disaster recovery 
plan. Section 35-8.1.4 discusses the contingency planning process. 

(e) Standard security procedures for users and 
operators of the system. Section 35-8.1.6 discusses standard security 
procedures. 
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35-8.1.3 Risk Management (See MIOG, Part II, 35-8.1.2.) 

(1) Risk management is the total process of identifying, 
controlling, and eliminating or minimizing uncertain risks that may 
affect system resources. Management must identify the resources to be 
protected and analyze the risks to determine the appropriate level of 
protection needed. The risk management process includes: risk 
analysis, as derived from an analysis of threats and vulnerabilities; 
management decision to implement security countermeasures and to 
accept residual risk; implementation and test of selected security 
countermeasures; and effectiveness reviews. 
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(2) A risk is derived. from the analysis of threats and 
vulnerabilities. Formal risk analysis requires determining relativity 
among risks and assessing associated damage or loss. This relativity 
forms the basis for selecting effective security countermeasures. The 
FBI does not currently have a standardized methodology for conducting 
a risk analysis. The DOJ Simplified Risk Analysis Guideline, FIPS PUB 
65, and the National Institute of Standards and Technology (NIST) PUB 
500-174 provide guidance. The FBI ADPT Security Officer shall be 
consulted, prior to the start of the risk analysis process, for 
guidance on the scope of the analysis and the recommended approach to 
be taken. _____ — — 



(a) Risk analysis will be conducted/sponsored by the 
ADPT Security Officer for each FBI ADPT mainframe/network facility. 
The risk analysis procedure will be conducted when a new or 
substantially modified ADPT facility design is approved and will be 
conducted: 

1. Prior to the approval of design 
specifications for new general support systems and their supporting 
installations. 

2. Whenever a significant change occurs to the 
general support system (e.g., adding a local area network; changing 
from batch to on-line processing; adding dial-up capability). 
Criteria for defining significant change shall be commensurate with 
the sensitivity of the data processed by the general support system. 

3. At periodic intervals established by the 
ADPT Security Officer commensurate with the sensitivity of the data 
processed, but not to exceed every three years if no risk analysis has 
been performed during that period. 



(b) The 
focuses on the technica 
techniques associated s 
including the interface 
application and/or the 
and the threats inheren 
results of a facility r 
defining and approving 
systems or network syst 



CSSO shall conduct a risk analysis which 
1 and administrative security, control 
pecifically with the system under review, 

between the operating systems and the 
communications environment and the application 
t in processing in a specific environment. The 
isk analysis are taken into account when 
security specification for the application 
ems. 



(3) Responsibility for implementation of the 
recommendations of a risk analysis rests with the manager of the ADPT 
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35-8.1.4 Contingency Planning (See MIOG, Part II, 35-7(5), 
35-8.1.2.) 



(a) Emergency response procedures appropriate to 
fire, flood, civil disorder, natural disaster, bomb threat or any 
other incident or activity which may endanger lives, property or the 
capability to perform essential functions. 



(c) Post-disaster recovery procedures and 
responsibilities, to facilitate the rapid restoration of normal 
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system or facility under review. Response to the recommendations * ,; 5 v|i 

contained in the risk analysis shall include implementation time lines Y|| 

or rationale for nonimplementation of recommended security :/0£ 

countermeasures. ADPT system managers must evaluate the ' v ^ 

recommendations made regarding the systems under review and determine %| 

whether to implement the recommendations based on technical and •'' ■^ , 

operational feasibility and cost. The FBI's accreditation authority -% 

will consider the effects of the reviewer's actions in making "* k;J 

accreditation decisions. ,-':'** 
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(1) Each ADPT system or grouping of like systems must be 
supported by a logical contingency plan. Well-written contingency 
plans, routinely reviewed, tested and updated, will enable vital K 
operations and resources to be restored as quickly as possible and '. 
keep system downtime to an absolute minimum, providing reasonable ^ 
continuity of ADPT support if events occur that prevent normal ^ 
operations. > -*i&- 

(2) The elements to be addressed as part of contingency 'fp& 
planning for all ADPT systems are: . ■;% 

"%, 

■ 'ij$ 



■•£■ 
. ■&: 

(b) Backup arrangements, procedures and "V 



responsibilities, to ensure that essential (critical) operations can 

be continued if normal processing or data communications are 

interrupted for any reason for an unacceptable period of time. The ,*| 

minimally acceptable level of degraded operation of the essential 

(critical) systems or functions will be identified and prioritized so .^ 

that the contingency plan accomplishes the priorities. 
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(3) Facility Disaster Recovery Plans address the 
protection of FBI ADPT general support system security and resources 
and will ensure the availability of critical Bureau resources, 
facilitating the continuity of operations during the emergency. The 
objective of an ADPT Installation Disaster and Continuity Plan is to 
provide reasonable continuity of computer center/telecommunication 
information technology support should events occur which prevent 
nprmaJL opjgr 3 ,tij)njLj_jrhe^AOTT Security Officer i s responsible for 



developing ADPT Installation Disaster and Continuity Plans and 
defining the testing requirements which will be implemented by the 
CSSO. 



(4) The CSSO shall develop and maintain in a current 
state, a contingency plan for each ADPT system, which will provide 
reasonable assurance that critical data processing support can be 
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operations at the primary site, or if necessary, at a new facility;.-'."'"' , 

following the destruction, major damage or other interruptions at the" v - 

primary site. ."'.'safe 
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continued, or resumed quickly, if normal operations of the system are ,^- 

interrupted. The contingency planning activities for an application 
system are conducted in -concert with facility disaster recovery 
planning and/or end-user contingency planning, when such plans exist. 
It should be noted that, depending on the results of the criticality 
assessment, the CSSO for a system may determine that the system is not „^ 
critical enough to the division or user community to warrant "||| 
developing and maintaining continuity of operations strategies for ^sgi 
interim system processing until normal operations are resumed. In .-J^ 
this event, the contingency plan will consist of a continuity of -re- 
operations statement to that effect. This is subject to the approval ,;j.. 
of the accrediting authority. r ^~. 

''fljf." 

(5) The Security Counter-measures Program Manager for a J' 
division is responsible for ensuring that End-User ADPT Contingency :^ 
Plans are in place for his/her division's microcomputer ADPT !£, 
resources. The plans also address the flivision's business continuity V; 
requirements for interfacing with applications supported by • !. 
application contingency plans. The ADPT Security Officer provides | 
guidance for the formulation of the plans. End-User ADPT Contingency ; ; ^ 
Plans are to be developed and/or reviewed and updated periodically or .4 
whenever a major change occurs in the processing environment, which 

includes the physical site, hardware, software, and/or operating .; 
systems. 

(6) All plans must be operationally tested at a frequency 

commensurate with the risk and magnitude of loss or harm that could .»*v 
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35-8.1.5 Certification (See HIOG, Part II, 35-8.1.2, 35-8.4, 
35-9.3.2.) 

(1) Cert i f i cat i on„is_the_AOBP^hensiye_s_ecuri ty_tes t and 



evaluation of the technical and nontechnical security features of a 
computer system and other safeguards, made in support of the 
accreditation process, that establishes the extent to which a 
particular design and implementation meet a specified set of security 
requirements. Certification primarily addresses software and hardware 
security countermeasures, but must also consider procedural, physical, 
personnel, and emanations security to the extent that these measures 
are employed to enforce security policy. 

(a) Custom developed software - Design reviews and 
systems tests will be performed, and a certification of the results 
recorded, for all newly developed software and for existing software 
when significant modifications are made. 

(b) Commercial off-the-shelf software (COTS) - 
Commercially procured software shall be examined to assure that the 
software contains no features which might be detrimental to the 
security of the ADPT system. Security-related software shall be 
examined to ensure, that the security features function as specified. 

(2) The CSSO shall oversee or conduct certification tests 
of the computer system. If resources are available', individuals who 
conduct the certification testing should be independent of the 
system's developers. The results of the tests shall be documented in 
a format such that the tests can be repeated, if required, to achieve 
the results reflected in the certification report. 

(3) The system security countermeasures should be 
modified to reflect the results of the certification testing, as 
appropriate. 

(4) The extent of certification testing will vary with 
the security mode of operation of the system. 
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- " (a) For dedicated security mode of operation, the •'• '" 

certification will focus on the physical, procedural, and personnel 
security measures . that ensure all users have the appropriate ' -> 
clearance, access approval, and need-to-know for all data on, the 
system. Since the system is not required to separate users and data 
with technical security measures, the certification effort will not be 
extensive. 

(b) For the system high-security modes of operation, 
the certification must cover the same factors as for the dedicated 
security mode. In addition, testing must establish that the hardware 
and software security features reliabl y se parate users from any data 
for which they do not have a need-to-know. 

(c) For compartmented and multilevel security modes 
of operation, specific certification tests will be designed pending 
DOJ approval (as discussed in Section 35-8.2(1) (b)) . 

(5) Guidance on conducting these tests shall be provided 
by the ADPTSO. . 
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35-8.1.6 Standard Security Practices (See MIOG, Part II, 35-8.1.2.) 

System security procedures shall be developed and provided 
to all users and operators. The procedures shall explain how the 
security mechanisms in a specific ADPT system work, so that the users 
and operators are able to consistently and effectively protect their 
information. The procedures should also be addressed in user 
training. 
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35-8.2 Accreditation (See MIOG, Part II, 35-6, 35-7, 35-8.1.1, 
35-9.4, 35-9.4.17.) 




(1) Accreditation is an official management authorization, 
to operate an ADPT system: in a particular mode of operation; with a 
prescribed set of security countermeasures; against a defined threat 
and with stated vulnerabilities and countermeasures; in a given 
operational environment; under a stated operational concept; with 
stated interconnection to other ADPT systems; and, at an acceptable 
level of risk for which the accrediting authority has formally assumed 
_respons ibi 1 ity.__The_accredi t ing_author.i.ty_acc.epts_ s ecur i_ty_ 



responsibility for the operation of an ADPT system and officially 
declares that a specified system will adequately protect information. 

(a) The security processing mode of an ADPT system 
will be determined based on the classification or sensitivity and 
formal categories of data and the clearance, access approval, and 
need-to-know of the users of the system. Formal categories of data 
are those for which a written approval must be issued before access 
(for example, SCI compartments or special access programs). The 
available or proposed security features of the system are not relevant 
in determining the actual security mode. All ADPT systems will be 
accredited to operate in one of the following security modes of 
operation wherein the following statements are satisfied concerning 
users with direct or indirect access to the ADPT system, its 
peripherals, remote terminals, or remote hosts: 

1. Dedicated Security Mode - all users possess 
the required personnel security clearance or authorization, formal 
access approval (if required), and need-to-know for all data handled 
by the ADPT system. 

2. System High-Security Mode - all users 
possess the required personnel security clearances or authorization, 
but not necessarily a need-to-know, for all data handled by the ADPT 
system. If the ADPT system processes classified information, all 
users must have formal access approval and signed nondisclosure 
agreements for all the information stored and/or processed (including 
all compartments, sub compartments, and/or special access programs). 

3. Compartmented Security Mode - all users 
possess a valid personnel security clearance for the most restricted 
information processed in the computers system; formal access approval 
for, and have signed nondisclosure agreements for that information to 
which they are to have access; and a valid need-to-know for that 
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(4) The system security plan, summary of compliance, and 
statement of' residual risk for classified systems must be reviewed by 
the DSO representative prior to accreditation. For sensitive systems, 
this documentation will be reviewed by the DOJ IRM-SPM representative 
prior to accreditation. 

(5) The appropriate FBI accreditation authority, i.e., 

the Assistant Director, NSD, for SCI systems and the SPM for all other 
systems, makes the accreditation decision based on the summary of 
compliance, statement of risk, and approved system security plan. The 
accreditation process results in a decision that the ADPT system is: 

(a) accredited to operate, or 

(b) given an interim approval to operate for a 
specific time pending satisfaction of specified requirements, or 
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4. Multilevel Security Mode - some users do not ?. "<?&£ 

have a valid personnel security clearance for all the information ^fj 

processed in the ADPT system; all users have the proper clearance and 
have the appropriate formal access approval for that information to 
which they have access; and all users have a valid need-to-know for 
that information to which they are to have access. '"~ 

(b) The dedicated security mode and the system high- ~'~&£: 

security mode are the only modes of operation authorized by the . C 

JVpar t-fflpnl-_frir_t-he i_proe.egs.ing _ of__cla,ssif ied and sen sitive information „ 

on ADPT systems. Exceptions to allow the operation of ADPT systems in 

the compartmented and multilevel security modes may be requested in --±g 

writing from the DSO by the SPM. (See MIOG, Part II, 35-8.1.5(4).) * .=> 

(2) All ADPT systems processing, storing, or transmitting -j£ 
classified or sensitive information must be submitted for v^' 
accreditation. Prior to processing, storing, or transmitting 4^ 
classified information, ADPT systems must be accredited. ADPT systems ?*£. 
used to process, store, or transmit sensitive information must be _-: 
accredited as expeditiously as possible. . "... 

(3) The system security plan documentation discussed in 

Section 35-8.1.2 shall be submitted by the CSSO to the FBI ADPT -^ 

Security Officer for review. The FBI ADPT Security Officer will /|_ 

develop a summary of compliance with ..security requirements and a 
statement of residual risk. 
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(c) denied permission to operate until the 
identified deficiencies or inadequacies are corrected. 

(6) Every FBI ADPT system covered by this policy must be 
reaccredited every 'three years. The accreditation status and 
supporting accreditation documentation shall also be reviewed and 
revised as appropriate under the following circumstances: 

(a) Significant changes in the hardware, software, 
or data communications configuration that impact security 
countermeasures defined in the original accreditation package. A 

■S.ignjfjrwr.^—^-^SP— ^I'^i^^g— ^^ h ^.gg e that need s to be brou ght to 

the attention of the accrediting authority. 
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(b) Changes in the sensitivity of the information 



(c) Changes in the security mode of operation. 
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(d) Relocation or structural modifications of the 
computer facility or remote terminal areas. 

(e) A breach of security, reported violation of 
security, or unusual situation that appears to invalidate the 
accreditation. 

(7) The accreditation package revision and review process 
will include: 

(a) Accomplishment of the same steps required for 
the original accreditation package. Those portions of the package 
that are still valid need not be redone. 

(b) The -system security plan, summary of compliance, 
and statement of residual risk will have to, be reviewed and approved 
by the DOJ IRM-SPM representative or DSO representative, as 
appropriate. 

(c) the appropriate FBI accrediting authority will 
review and reaccredit the ADPT system. 

(8) The FBI ADPT Security Officer shall maintain a record 
system containing the status of all of the documents in the 
accreditation packages for the FBI's systems. 

(9) The accrediting authority for a system is the only 
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person authorized to exempt an operation from the security' ■'■' *^T 

requirements specified in the accreditation statement. This exemption . .■ 

shall be formally documented and shall be retained with the original <T ^v 
accreditation package. 
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.35-8.3 Secur ity_Educati on, _. Training ,_and_ Awareness _.(See_ MI0G,^ „ . li 

Part II, 35-7(5), 35-9.2.) 

(1) The ISSU, SCMS, NSD established an ADPT Security 
Education, Training, and Awareness Program for the FBI. This training 
shall be extended to all personnel who manage, use, or operate an FBI 

ADPT system, whether they are employed by the FBI or not. This ■■-^ 

includes Joint Task Force (JTF) members utilizing any FBI ADPT system ' f_ 

(e.g., other federal, state, or local police personnel utilizing FBI 

microcomputers in an off-site), members of other federal agencies in ^v 

non-JTF capacity, and any contractor personnel utilizing FBI ADPT 

systems. The goal of the training program is to ensure that these 

personnel are made aware of: threats, vulnerabilities, and risks 

associated with the ADPT systems; what requires protection; ;f 

information accessibility, handling, marking, and storage ■ ',*$, 

considerations; physical and environmental considerations necessary to "?;:■ 

protect the ADPT system; system, data and access controls; contingency 

plan procedures; secure configuration control requirements; ';*. 

responsibility to promptly report security violations to the CSSO; 

and, responsibility to report to the SPM if the security training 

appears inadequate. ,£ 

(2) All new employees will receive a security awareness . ;.; 
briefing within 60 days of their appointment, as part of their 

orientation. Continuing training shall be provided whenever there is 

a significant change in the agency information systems security 

environment or procedures or when an employee enters a new position ' 

which deals with sensitive information. Refresher training shall be 

given as frequently as determined by the SCMPM, based on the 

sensitivity of the information that the employee uses or processes. 

All FBI employees will be provided with refresher awareness material 

or briefings at least annually. 

(3) Each person receiving training shall complete a 
Notice of Responsibility and Computer Security Awareness Certification 

'■i* 
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11 be retained by the 



I upon completion of each training-course which wi 
SCMPW. (See Section 35-13.1.) Guidance on the tracking of these 
"training-activities will be provided by ISSUj SOIsTnSD. 
~^—.^.- , _.,„__.„, .■ .-.•..»■■ •", _'.,.^ v »>^---.-~-"^' . 

(A) ADPT' security training above the awareness level... 
ahalJ be provided to all personnel who design, implement,, or maintain 
systems regarding the types of security and. internal control 
techniques that should be incorporated into system development, 
operation and maintenance. The division should consult with the 
ISSU, SCMS, NSD for_guidance on achieving these training objectives.^ 
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J 35-8.4 Security Oversight (See MIOG, Part II, 35~7 (3) (k) . ) 

(1) The ADPT security program is implemented through 
several policy actions: appointment of CSSOs, acquisition reviews, 
review and approval of security requirements to support system 
development; preparation and approval of accreditation documentation; 
and security incident reporting. 

(2) Given the global nature and participation of the FBI 
ADPT resources, the appointment of CSSOs to assist in ensuring 
adherence to and to provide a point-of-contact for accomplishing ADPT 
security activities has been established. CSSOs shall be appointed 
for all ADPT systems. 

■%■ 

(3) The FBI's Inspection Division reviews ADPT security 
as part of a division's- periodic inspection. The FBI ADPT Security 
Officer will coordinate with the Inspection Division on the status of 
ADPT security within a division upon completion of the inspection. 
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(4). Whenever an office makes a major move, e.g., 
relocates to a new building, the division's Security Countermeasures 
Program Manager should conduct a compliance review to determine 
whether the change in physical location has had an impact on the ADPT 
security posture. The Division's Security Countermeasures Program 
Manager should consult with the Security Countermeasures Section and 
should retain the results of the security review as part of the 
division's security documentation. 

(5) As is current practice, the FBI shall continue to 
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enforce ADPT security as part of the acquisition process. The * ~; -~' 7 'fS&* 

Information Systems Security Unit must approve ADPT-related -T 

acquisitions, as discussed in Section 35-8.1.5. The ISSU should .' .■'.:$& 

maintain formal records of acquisition activities to ensure that ;' : }'-7 
security plans are either developed or modified to reflect the 

acquisitions. The ADPT Security Officer reviews and approves all J.. 

ADPT-related acquisitions to certify that the appropriate ADPT '>'%• 
security requirements are included in the specification for the 
operation of an ADPT installation facility, equipment, application 
system, or acquisition of ADPT hardware, software, or related 
services. COTRs for a contract action should ensure that the ADPT 

securit y-related requ iremen ts are adhered to b y the contrac t ors ■ ■ #'4 

throughout the life cycle of the contract. ~-'3V 

(6) The ADPT Security Officer shall ensure that periodic *-^g- 

system security reviews are conducted. Even if there are no changes .. ifi 

to the security posture of a system or division, ADPT systems will be ^te| 

reviewed and reaccredited if three years have elapsed since the date 
of certification of the security posture. The ADPT Security Officer 
shall develop, with the assistance of the SPM and the SCHPHs, a list 
of ADPT systems requiring accreditation. This list should include the 
recommended priority and the accrediting authority for each ADPT 
system to be accredited. This list shall be verified annually. 
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35-9 MINIMUM SECURITY REQUIREMENTS (See MIOG, Part I, 261-2.) W~ 

-vf- 

(1) The goal of ADPT security is to develop a 'Ik: 
functionally secure, efficient, cost-effective environment based on an X* 
assessment of security risks and safeguards. All ADPT systems ';j 
processing, storing or transmitting classified or sensitive '~'r' 
information shall meet the requirements of this policy through J^ 
automated or manual means. More stringent requirements may be imposed "'" 
based on a risk analysis. Classified and SCI systems will also - -*• 
conform to the provisions of DCID 1/16, "Security Policy for Uniform 7'j. 
Protection of Intelligence Processed in Automated Information Systems 

and Networks (U)," 19 July 1988. '■'}? 

(2) This section documents the minimum security ^ 
requirements for all FBI ADPT systems with respect to facility 

security, personnel security, administrative security, technical ~ 
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security features,' emanations security, and communications security. 
Related security disciplines are referenced where appropriate. 



EFFECTIVE: 07/26/95 






<■ .Mm. 



••V'iV.SsVV 



?m 



■:# 




35-9.1 Facility Security 



_(1) Facility. security .addresses the requirement to 



provide physical and environmental security controls commensurate with 
the level of risk to the ADPT systems supported in a facility, as 
identified by a risk analysis. The security controls must not be less 
than the minimum requirements discussed in this section unless a 
written waiver has been granted by the accrediting authority, i.e., 
the SPM for non-SCI systems and the Assistant Director, NSD for SCI 
systems. 

(2) For, the purposes of this policy, an ADPT facility 
includes any space housing ADPT equipment such as terminals, 
microcomputers, mainframe systems, communications equipment and/or 
supporting environmental control utilities. Facilities also include 
data storage libraries and ADPT system documentation libraries. 



* 




EFFECTIVE: 07/26/95 



35-9.1.1 Physical Security 

(1) Physical security is that part of the FBI's facility 
security program which is concerned with the physical measures 
designed to prevent unauthorized physical access to equipment, 
facilities, material, information, and documents, and to safeguard 
them against espionage, sabotage, damage, tampering, theft and other 
covert or overt acts. ADPT hardware, software, documentation, and all 
classified and sensitive information handled by the ADPT system shall 
be protected to prevent unauthorized disclosure, modification, or 
destruction. ADPT system hardware, software, or documentation shall ' 
be protected if access to such resources reveals information that may 
be used to eliminate, circumvent, or otherwise render ineffective the 
security countermeasures for classified or sensitive information. 
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(2) Classified or sensitive FBI information must be ' "°ifr 
processed, stored, or transmitted in spaces which are under exclusive i; 
FBI control while operational. When not in operation or under the ijl' 
direct personal control of an authorized person, FBI ADPT systems and 
information must be protected by storage areas, storage equipment, 
and/or systems or measures which are consistent with the FBI's 
facility security program. 

(3) The SPM prescribes policies, procedures, and 
standards for the FBI's facility security program. ADPT security 
planning must take into consideration the facility security .program 
pr ior to co nductin g ADPT o p erations , at any location , as part of the 



(4) More stringent physical security controls are 
required to support the processing, storage, and transmission of SCI. 
This activity will be subject to the provisions of DCID 1/16 which 
states the processing of SCI data must be restricted to an accredited 

-v SCI Facility (SCIF) and SCI may not be stored on nonremovable storage 
| media except in accredited SCIFs approved for the open storage of SCI. 
DCID 1/21 provides SCIF physical security criteria. There are 
instances where other facility security-related rules and requirements 
apply, too (e.g., the Legal Attaches must comply with Department of 
State standards in addition to the FBI requirements). 
| [Network and Information Systems Support Unit (NISSU) , |OMS, IRD 
conducts surveys and develops the specifications for SCIFs and for the 
field offices and Legal Attaches. These activities are coordinated by 
the SPM, who is also the accrediting authority for the FBI's SCIFs. 

(5) For all types of facilities where classified or 
sensitive information is stored, processed, or transmitted, physical 
access will be restricted to those individuals who are cleared and 
authorized in accordance with the personnel security requirements 
discussed in Section 35-9.2 and who are necessary to complete job 
functions and related duties. All uncleared personnel granted 
facility access must be properly escorted and restricted to those 
areas necessary to complete their tasks. Classified and sensitive FBI 
information must be protected from unauthorized disclosure to such 
persons. 
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[ 35-9.1.2 Environmental 

(1) Environmental controls address the requirement to 
provide appropriate temperature and humidity controls, fire 
protection, power, and natural disaster protection necessary to ensure 
the continuity of ADPT facilities, equipment, and operations. 

(2) An office area that supports desktop ADPT equipment, 
such as microcomputers, does not require additional environmental 
controls beyond the requirements specified for human safety and 

_comf or.t . __ __ 
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(3) ADPT facilities supporting large-scale ADPT 
operations, such as mainframe computer and telecommunication 
facilities, require consideration of additional environmental controls 
as determined by a facility risk analysis. The following additional 
environmental controls shall be considered. ' 







(a) Fire prevention, detection, suppression and 
protection measures. 

(b) Controls that reduce the risk of water damage, 
provide water detection, and corrective measures, and water hazard 
prevention devices. 

(c) Electric power supply protection. 

(d) Temperature and humidity control. 

(e) Natural disaster protection from earthquake, 
lightning, windstorm, and other natural disasters. 

(f) Housekeeping protection from dirt and dust. 

(g) Personnel safety features. 
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^rUten'a^fetlS^ "the Di^ct# of Hhe^ FBI^or his delegate,; any ^ ■? 
information from the investigatory files of the. FBI or any -v ,;J , v- J; .^ ; . , .,; 
information relating to material, contained in the files, or disclose.^ ^- 
any information or produce any material acquired as *V"}.?\£* t ^p-/*\ 
performance of my official duties.or because of my official status. .,. ,, ; 
The burden is on me to determine, prior to disclosure, whether : . _ ,- _ 
information may be disclosed and in this regard T agree to request ; ^ • 
approval of the. Director of the FBI in each such instance by . . , t :4 ; , ; ; 
presenting the full text of my proposed disclosure in writing to the 
Director of the FBI at least thirty (30) vdays prior to disclosure. I 
understand that this agreement is not intended to apply to- 
informati.on_which_hasJ)een_plac.edan_the_p^ 
'me from writing or speaking about the FBI, but it is fended to ^ 
prevent disclosure of information where disclosure would be contrary 
to the law, regulation, or public policy. I agree the Director of 
the FBI is in a better position than I to make that determination. 

3 I agree that all information acquired by me in connection with my 
duties while on assignment with the FBI and all off cial material to 
which I have access remains the property of the United States of 
America, and I will surrender upon demand by the Director of the FBI 
or his delegate, or upon separation from the FBI, any ** te "f 
relating to such information or property in my possession. I «" 
agree assignment to the United States of any profits resulting from 
the publication of information in breach of this agreement. 

4. I understand that obtaining information under false pretenses or 
any unauthorized disclosure may be a violation of Federal law and 
pros«u?ed as a criminal offense and, in addition to this agreement, . 
may be enforced by means of an injunction or other civil remedy, I 
also understand that the use of the FBI network and its automated 
Information systems, i.e., the Automated Case Support (ACS) System,; to 
access records other than in furtherance of authorized .■■'.*.. . 
responsibilities will be viewed as obtaining information under false 
pretenses and may be in violation of the Privacy Act. -IV'^;*-; , V< 

5. I agree thaCaU 1 ! the information that I will access will be for , - ( 
the sole purpose of authorized and lawful purposes in furtherance . of :^ 
Jhe responsibilities of the. particular Joint Task. Force or contract ,, 
under which the user is being provided access. (JTF/Contract ____'~ 








I accept the above provisions as conditions for my .assignment and 
continued assignment in the FBI. I agree to comply with these 
provisions both during my assignment in the FBI and follow ng _ 
termination of such assignment. I have read this Agreement carefully 
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35-9.2 Personnel (See MIOG, Part II, 35-9.1.1, 35-9.4.1, 
35-9.4.5.) 
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(1) All personnel who have been entrusted with the 
management, operation, maintenance, or use of an FBI ADPT system 
processing, storing, or transmitting sensitive and/or classified 
information require the appropriate personnel security approval. The 
SCMS, NSD, sets policy and. provides procedures and guidance in support 
of the FBI's personnel security program. ADPT security planning must 
take into consideration the personnel security program prior to 
conducting ADPT operations as part of the accr editation proces s for an 
FBI ADPT system. 

(2) All FBI personnel hold Top Secret security 
clearances. MIOG, Part I, Section 67-7 through 67-7.11, provides 
policies and procedures for personnel security clearances for Bureau 
employees. 

(3) Non-Bureau personnel who have been entrusted with the 
management, operation, maintenance, or use of classified FBI ADPT 
systems require Top Secret security clearances. See MIOG, Part I, 
Sections 259 and 260. Personnel security approvals for nonclassified 
FBI ADPT systems are documented in the System Security Plans for these 
systems. 

(4) Non-Bureau personnel who are required to perform 
maintenance on FBI ADPT systems within FBI controlled space and who do 
not require access to classified systems may be approved for escorted 
access based on an FBI-conducted Limited Background Investigation. 
This activity shall be coordinated by the SPM. Refer to MIOG, Part I, 
Section 260, "Industrial Security Program," particularly 260-4.1.1. 

(5) Personnel must be indoctrinated, as required, prior 
to being granted access to FBI ADPT systems that support special 
access programs. The provisions for special access programs are 
discussed in MIOG, Part II, Section 26-10.2. 

(6) ADPT security training must be provided to all 
personnel who manage, operate, develop or use ADPT systems. Refer to 
Section 35-8.3. 

(7) The SCMPM shall ensure that debrief ings are 
conducted, as required by MIOG, Part I, Section 261-2. 
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35-9.3 Technical Security Features (See MIOG, Part II, 35-9.4.2, 
35-9.4.6.) 
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The purpose of this section is to establish near-term 
requirements and long-term goals to improve the security of the 
Bureau's ADPT systems through increasing reliance on technical 
security features. The minimum technical security requirements 



addressed in Sections 35-9.3.1 and 35-9.3.2 are technically feasible - 
in the Bureau's current ADPT environment and shall be addressed. As 
technology evolves, the desirable technical security features, 
identified in Section 35-9.3.3 should be addressed during the system 
planning process. 
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35-9.3.1 Minimum Technical Security Requirements (See MIOG, Part 
II, 35-9.3, 35-9.4.2.) 

(1) ADPT systems used for the processing of classified or 
sensitive information in the System High Security Mode of Operation 
must have the functionality of the C2 level of trust defined in the 
Department of Defense. (DoD) 5200.28-STD, "Department of Defense 
Trusted Computer System Evaluation Criteria." The Trusted Network 
Interpretation of the Trusted Computer System Evaluation Criteria, 
National Computer Security Center Technical Guide 005 (NSC-TG-005) , 
provides guidance on achieving C2 functionality in a network. Other 
safeguards which maintain the level of system security commensurate 
with the sensitivity of the data may be substituted in cases where C2 
requirements are time-consuming, technically unsound, or adversely 
affect operations to an unacceptable degree. The Department Security 
Officer must approve exceptions to C2 for classified systems. The 
IRM-SPM must approve such exceptions for sensitive systems. 
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(2) Systems operated in the Compartmented or Multilevel 
Security Mode of Operation require additional security controls and 
will be addressed on a case-by-case basis. The ADPT Security Officer 
shall be consulted to ensure that the technical security requirements 
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are adequately addressed. These modes of operation require approval- 
by the Department Security Officer. . " 

(3) FBI ADPT operations involving classified information 
and SCI must be conducted in accordance with the provisions of 
Director of Central Intelligence Directive 1/16, "Security Policy for 
Uniform Protection of Intelligence Processed in Automated Information 
Systems and Networks." The ADPT Security Officer shall be consulted 
prior to defining the security requirements for classified and SCI 
systems to ensure that the technical security requirements defined in 
DC ID 1/16 are adequately addressed. 
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(4) The design of ADPT systems that process, store, or 
transmit classified or sensitive information must include, at a 
minimum, the technical security features discussed in this section. 
Security countermeasures shall be in place to ensure each person 
having access to a computer system is individually accountable for 
his/her actions on the system. 

(a) User Identification - The ADPT system shall 
control and limit user access based on identification and 
authentication of the user. The identity of each user will be 
established positively before authorizing access. User identification 
and password systems support the minimum requirements of access 
control, least privilege, and system integrity. 

(b) Authentication - For ADPT system requiring 
authentication controls, the ADPT system shall ensure that each user 
of the ADPT system is authenticated before access is permitted. 
Currently, use of a password system is the preferred method for 
authenticating users of FBI ADPT systems. Passwords will be 
authenticated each time they are used. FIPS PUB 83 provides standards 
for authentication. More sophisticated authentication techniques, 
such as retina scanners or voice recognition systems, must be cost*" 
justified through the risk analysis process. 

(c) Audit Records - All systems transactions are 
subject to recording and routine review for inappropriate or illegal 
activity. Audit trails should be sufficient in detail to facilitate 
reconstruction of events if compromise or malfunction occurs. Audit : . 
trails should be reviewed at least once weekly, or as specified in the" 
system security plan. The audit trail should contain at least the 
following information: 
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1. The identity of each user and device having 
access to the system or attempting to access the system. 
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date of log-off. 



2. The tine and date. of the access, time and 




3. Activities that might modify, bypass, or 
negate security safeguards controlled by the computer system. 



Security-relevant actions associated with 



processing. 



(d) Object Reuse - All classified and sensitive ADPT 
systems sh all clea r memory and storage before reallocation to a ._ 



different user. This prevents one user from obtaining another user's 
residual data. 

(e) Access Control - For systems operating in the 
System High Security Mode of Operation, this may be implemented 
through discretionary access control techniques through measures such 
as file passwords, access control lists, disk encryption or other 
techniques, as defined in the approved system security plan. For ADPT 
systems operating in the compartmented or multilevel security mode, 
mandatory access control (MAC) is required. MAC is a means of 
restricting access to information based on labels. A user's label 
indicates what information the user is permitted to access and the 
type of access (e.g., read or write) that the user is allowed to v 
perform. An object's label indicates the sensitivity of the 
information that the object contains. A user's label must meet 
specific criteria defined by MAC policy in order for the user to be 
permitted access to a labeled object. This type of access control is 
always enforced above any discretionary controls implemented by users. 

(5) The following additional technical security control 
requirements apply to FBI ADPT systems: 

(a) Internal Labeling - By definition, compartmented 
mode and multilevel secure modes of operation require internal 
labeling. In addition, for systems operating in other modes and 
processing multiple classifications of information (e.g., Sensitive - 
and Secret), security classification labels shall be associated with 
all data within the system. 

(b) Standard Warning Banner - This banner addresses 
the concerns that those individuals who are using ADPT systems without 
or in excess of their authority, and those authorized users who are 
subject to monitoring, be told expressly that by using the system they 
are consenting to such monitoring. It also provides a basis for 
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establishing the "knowingly" and "with intent" provisions of Title 18,- 
USC, Section 1030, should prosecution become necessary. The 
following banner shall be displayed on all FBI ADPT systems at a point 
prior to the user signing onto the system: 

"This FBI system is for the sole use of authorized users for official 
business only. You have no expectation of privacy in its use. To 
protect the system from unauthorized use and to insure that the system 
is functioning properly, individuals using this computer system are 
subject to having all of their activities on this system monitored and 
recorded by system personnel. Anyone using this system expressly 
consents to such monitorin g an d is advised that if such monitorin g 



reveals evidence of possible abuse or criminal activity, system 
personnel may provide the results of such monitoring to the 
appropriate officials." 

(c) Inactivity Time Out - The ADPT system shall lock- 
out an interactive session after an interval of user inactivity not to 
exceed thirty minutes. The time interval and restart requirements 
shall be specified in the system security plan. 

(6) Interconnections between sensitive and classified FBI 
ADPT systems and non-FBI ADPT systems must be established through 
Controlled Interfaces. The ADPT Security Officer must be consulted 
for guidance on establishing controlled interfaces. The controlled 
interfaces used in an ADPT system implemented as a network shall be 
accredited at the highest classification level and most restrictive 
classification category of information on the network. The controlled 
interface function of an ADPT system is composed of a combination of 
gateway and guard functions. Gateways provide a secure point of 
interconnection between networks, connected peripheral devices, remote 
terminals, or remote hosts, and provide a reliable exchange of 
security information to allow secure interconnections between 
components. Automated guard processors and security filters 
(hereafter referred to as guards) are software or hardware/software 
techniques or specialized equipment that filter information in a data 
stream based on associated security labels and/or data content. For 
example, a guard might accept an input data stream of information of , 
mixed classifications up to SECRET, but permit only data classified up 
to CONFIDENTIAL to pass. . - 
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35-9.3.2 Security Assurances (See MIOG, Part II, 35-9.3 & 
35-9.4.2.) 

(1) ADPT systems shall be examined when received from the 
vendor and before being placed into use. 









■ --€11 

.'.tW- 






(a) Hardware - an examination shall result in 
assurance that the equipment appears to be in good working order and 
have no "parts" that might be detrimental to the secure operation of 
the resource when placed under FBI control and cognizance. Subsequent 
_changes._and_developpents^hi_ch_afXect^ 

examination. The emanations security requirements stated in Section 
35-9.5 also apply. 
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(b) Commercial Software - Commercially procured 
software shall be examined to ensure that the software contains no 
features which might be detrimental to the security of the ADPT 
system. Security-related software shall be examined to assure that 
the security features function as specified. 

(c) Software Developed In-house - New or 
significantly changed software and hardware developed by or 
specifically for the FBI shall be subject to testing and review at all 
stages of the development. 

(2) The FBI endorses the use of products from the 
Evaluated Products List (EPL) which is maintained by the National 
Computer Security Center. Products on the EPL are computer systems, 
software or components that protect information while it is being 
stored or processed. They have been evaluated by the government as to 
the degree of trust that can be placed in them. In' order to assess 
this, the DoD Trusted Computer System Evaluation Criteria was written 
and products were evaluated against this criteria and given a level of 
trustworthiness. When certified to be properly implemented through 
the process discussed in Section 35-8.1.5, these products shall be 
accepted as meeting the security requirements for the portion of the 
ADPT system where they are used. 

(3) If products from the EPL are not specified or used, a 
functionality statement is required to discuss how the trusted 
computing base functionality will be achieved and a time frame for- 
full implementation to the appropriate level of trust will be 
included. The functionality statement will become part of the 
accreditation decision. The areas to be addressed in the system 
security planning phase include: 
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(a) Confidence in Software Source - In acquiring 
resources to be used as part of an ADPT system, consideration shall be 
given to the level of confidence placed in the vendor to provide a 
quality product, to support the security features of the product, and 
to assist in the correction of any flaws. 

(b) Security Performance Testing - Security 
performance testing includes both certification testing that is 
performed before the ADPT system is accredited and ongoing performance 
testing. that is performed on a regular basis. 




(c) Flaw Discovery - For ADPT systems operating in 
the compartmented security mode or multilevel security mode, the 
vendor shall provide a method for ensuring the discovery of flaws in 
the system (hardware, firmware, or software) that may have an effect 
on the security of the ADPT system. 

(d) Security Penetration Testing - In addition to 
testing the performance of the ADPT system operating in the 
compartmented security mode or multilevel security mode, there shall 
be testing to attempt to penetrate the security countermeasures of the 
system. The test procedures shall be documented in the test plan for 
certification and also in the test plan for ongoing testing. 

(e) Description of Trusted Computing Base Protection 

- The protection and provisions of the trusted computing base shall be 
documented in such a manner to show the underlying planning for the 
security of an ADPT system operating in the compartmented security 
mode or multilevel security mode of operation. The trusted computing 
base shall be isolated and protected from any user or unauthorized . 
process interference or modification. Hardware and software features 
shall be provided that can be used to periodically validate the 
correct operation of the elements of the trusted computing base. 

(f) Flaw Tracking and Remediation - For ADPT systems 
operating in the multilevel security mode of operation, the vendor 
shall provide evidence that all discovered flaws have been tracked and 
remedied. 

(g) Life-Cycle Assurance - The development of 
hardware, firmware, and software shall be conducted under life-cycle 
control and management. 

(4) Configuration Management - At a minimum, a 
configuration management system shall be in place that maintains 
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control of changes of any of the system's technical features that may 
alter the accreditation status. Examples include security-related 
hardware or changes of any line of source or object code of the 
security-related software. The system will record by whom, for what 
reason, and when the change is made. Up-to-date documentation of the 
security-related hardware and/or software design will be maintained. 
This is a requirement to preserve the integrity of accreditation. 
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35-9.3.3 Desirable Technical Security Features (See MIOG, Part II, 
35-9.3.) 

(1) As technology evolves, system planning should address 
the achievement of the technical security features addressed in this 
section. The goal' is to achieve a multilevel security mode of 
operation for all FBI ADPT systems and to provide a trusted path from 
the workstation forward. A multilevel secure environment allows the 
FBI to expand the efficiency of information processing. The planning 
process shall be documented and approved through the system security 
plan. 

(2) Interoperability With External Systems - Support for 
digital signature standards, nonrepudiation in messaging systems, and 
data encryption issues should be provided as they relate to 
interagency communications or interoperability. 

(3) Continuous On-Line Automated Monitoring and Warning - 
The ADPT system shall provide for continuous, real-time monitoring 
(audit) of use and real-time warning to the CSSO of suspected misuse. 

(4) Network Access Control Features . - The following areas 
shall be addressed to achieve a trusted communications path: 

(a) Identification and Authentication Forwarding - 
Reliable forwarding of the identification shall be used between ADPT 
systems when users are connecting through a network. When 
identification forwarding cannot be verified, a request for access 
from a remote ADPT system shall require authentication before 
permitting access to the system. 
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(b) 


Protection of Authenticator Data - 
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the authenticate information and any tables (e.g., password tables)' 
associated with it, the data shall be protected from access by , 
unauthorized users (e.g., by encryption) and its integrity shall be 
ensured. 
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(c) Methods of Continuous, On-line Monitoring - 
Monitoring of network activities shall be included in each network 
operating in a multilevel security mode. This monitoring shall also 
include real-time notification to the CSSO of any system anomalies. 

(5) Secure Message Traffic - The communications 
methodology for the network shall ensure the detection of errors in 



traffic across the network links and the retransmission of erroneous 
traffic. 

(6) Security Label Integrity - For an ADPT system 
accredited to operate in the compartmented security mode or 
multilevel security mode, the communications methodology shall ensure: 
integrity of the security labels; the association of a security 

label with the transmitted data; and enforcement of the control 
features of the security labels. - 

(7) Device Labels - For an ADPT system accredited to 
operate at the compartmented security mode or multilevel security 
mode, the communications methodology shall ensure that the originating 
and destination device labels are a part of each message header and 
enforce the control features of the data flow between originator and 
destination. 
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I 35t9.4 Administrative Security and Accountability 

(1) Administrative security is the administrative 
controls and operational procedures used in conjunction with or in 
place of technical security features to achieve a level of security! 
consistent with the sensitivity of the information processed, stored, 
or transmitted by FBI ADPT systems. The applicable administrative, 
security controls are documented in the system security plan for a 
system. 

(2) The CSSO shall establish access control criteria and 
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administrative procedures to control access to information 
processed, stored, or transmitted by FBI ADPT systems. Access is 
defined as the ability and the means to approach, communicate with 
(input to or receive output from), or otherwise make use of any 
material or component in an ADPT system. These activities are 
documented through the system security planning process, approved by 
the ADPT Security Officer and accredited as discussed in Section 
35-8.2. 
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35-9.4.1 



Access Control Criteria (See MIOG, Part II, 35-7(6), 
35-9. A. 4.) 







(1) The access control criteria shall identify who is 
authorized to access the system, and identify responsibility for 
approving all access to the system. The individual who requires 
access must possess the appropriate security clearance and have the 
need to know, i.e., access to the information is an operational 
necessity. Moreover, the system security features must have the 
technical ability to restrict the user's access to only that 
information which is necessary for operations and for which the user- 
has clearance. 

(2) Bureau personnel accessing internal FBI ADPT systems 
must have Top Secret security clearances (as discussed in Section 35- 
9.2). Personnel must only be granted access to systems for which they 
have a valid need to know based on their operational necessity (e.g., 
an individual working in the Personnel Division would not require - 
access to case information). 

(3) |Non-Bureau individuals operating in|Joint Task Forces 
(JTF) , other federal agencies in non-JTF capacity, and/or private 
contractors to support particular (operations will be granted limited 
access to FBI systems. Access will be limited to the privileges 
assigned to nonsupervisory Special Agent personnel with access to " 
unrestricted case classifications and cases. In limited 
circumstances, SACs may request supervisory access for non-Bureau 
individuals who serve as task force supervisors.! 



reviewed. 



(a) Each request for access must be individually 
The review criteria are: 






"4 






s„ 






Sensitive • 
PRINTED: 02/18/98 






mmrn 



wm 



urn 



mm 







Sensitive 



Manual of Investigative Operations and Guidelines 
Part II -. / 



security clearance. 



' PAGE 35 

1. The individual must possess a Top Secret 
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2. The individual must have the need to know, 
i.e., access to the information ia an operational |necessity; SAC/AD 
recommendation and the (sponsoring division of the application|must 
concur. ■ 
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3- The system security features must have the 
technical ability to restrict the user's access to only that 
information which is necessary for operations and for which the user 
has cle arance ._ 



(b) All requests must be submitted in writing to: 
the sponsoring division of the application, for need-to-know criteria; 
the SPM, for personnel security clearance status; and, the ADPT 
Security Officer, for evaluation of the technical security features. 

(c) The SPM will be the final adjudicator of all 
access authorization and will maintain a list of non-Bureau personnel 
who have been authorized access to FBI ADPT systems. 
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(4) | The non-Bureau individual must receive Computer 
Security Awareness Training, Application Training and execute an FBI 
nondisclosure agreement (FD-868) defined in MIOG, Part II, 35-13.2. | 

| (5) J The FBI also operates systems designed for the 
support of the criminal justice community, (e.g. , |NCIC) . | Because these 
systems have not been designed for internal FBI use, personnel 
accountability requirements are defined for each system and are 
documented in the System Security Plans for these systems. Certain 
provisions of Section ,.35-914.1 may not apply to these systems. 
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(a) Each user of an FBI ADPT system must be uniquely 
identified. User identification (ID) will not be shared. 



(e) If passwords are selected as the authentication 
mechanism for a system, password usage shall meet the standards which 
are set forth in FIPS PUB 112: 



2. Passwords shall be changed when a security 
violation is suspected or known. 

3. All vendor or default passwords shall be 
changed prior to system implementation. 

4. A password shall be protected commensurate 
with the information to which it provides access. Password 
distribution methods shall be provided protection equivalent to the 
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35-9.4.2 Administrative Procedures (See MIOG, Part II, 35-137). ,|> 

(1) Administrative procedures support the access control ■■'£' 
mechanisms (i.e;, the applicable technical security features discussed ,£-■ 
in Section 35-9.3) and assign responsibility for administering the £% 
mechanisms. 

(2) Access control mechanisms provide identification and 
authentication features as discussed in Section 35-9.3. These £ 
features are administered as follows: '■'■£' 
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(b) Users of FBI ADPT systems will be restricted to 
only those privileges necessary to perform assigned tasks. ^ 
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(c) Super-user or system programmer privileges will . 
be granted on a selective basis and will identify any constraints 
applicable to privileged users. 

~Kd) User accounts that have been inactive for over 
90 days will be suspended. The person responsible for administering 
the access control mechanism is authorized to reinstate such accounts 

up to 180 days overall. User accounts that have been inactive for 180 $': 

days will be deleted and may only be reissued by the person authorized ■'■% 

to approve access who is identified in the access control criteria and ',V' 

only to an individual who has been authorized access. "\. 
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1. Passwords shall be changed at least every 90. 
days . . ■ ■ ifff. 
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level of information the passwords protect. T *' •""' %.&•'''' 

(f) At the time of password issuance, users must be 
briefed on the following: " 

1. Password classification and exclusiveness. 

2. Measures to safeguard "classified" and 
"sensitive" passwords. 



-other_personnel— 
password misuse. 



3. Prohibitions against disclosing passwords to 



4. Responsibilities for notifying the CSSO of 
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| 35-9.4.3 Internal Controls 

(1) Office of Management' and Budget (0MB) Circular A- 
123, "Internal Control Systems," prescribes the policies and 
procedures to be followed by departments and agencies in establishing, 
maintaining, evaluating and reporting on internal controls in their 
program and administrative activities. 0MB Circular A- 123 requires 
that an organization establish and maintain a cost-effective system of 
internal controls to provide reasonable assurance that government 
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Password change procedures. -^ 



(3) All systems transactions are subject to recording and '^ 

routine review for inappropriate or illegal activity. Audit logs ' n ''~ 

should be reviewed as specified in the system security plan. Audit - >4; 

logs should be retained according to the retention period specified in "• 

the system security plan. Evidence of security violations must be "~ 
reported to the ADPT Security Officer. The contents of audit logs are 

described in Section 35-9.3.1. ^ 

■ a u 

. ' :***'■■ " 

, (4) When an individual who has been granted access to an '''%.' 

FBI ADPT system no longer requires access privileges, the CSSO shall ,.;.<* 

ensure that the individual's identification (ID), passwords, and other ■'■•'•' 

access codes are immediately removed from all ADPT systems. i --" 
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resources are protected against fraud, waste, mismanagement, and "■''%& 

misappropriation. ■■„''.■• '•. *• ' ;.£$#■ 

'''"■•'">»-■'" ''"' - ' ■ '' ' ' •■' ■ ''^'2^*- ; ' 

(2) Control techniques that support of the internal <t3? 

control objectives for FBI ADPT systems include, but are not limited {$£$: 

to the following: ' *"*' 






(a) Key duties and responsibilities in authorizing, %" 
processing, recording, and reviewing system-related activities should ' & 
be separated among individuals to the extent practical in the : l«if|? 
organizational structure. For example, system security-related and *^ 

-general-system _operational_duties-.should_be-.performed_by_separate_ ?^fo' 

individuals. *ffi 

■ ■'■f*k. 

(b) Individuals assigned primary, responsibility for. . fv&S 
performing critical functions in support of the ADPT system (e.g., 
system administration, security administration, system operations, 
programming, etc.) should have trained alternates who can perform 
these functions in the event the individual who is assigned primary „.. 

responsibility is unavailable. ~*M 

' - j$& 

ri W,. 

(c) System life cycle documentation should exist to f| 
reflect the current state of the ADPT system as it is being operated. 1%? 
The documentation must be sufficient to ensure effective operation by ""''ft 
users and system maintenance by programmers. -'■'■'£& 
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(3) The risk assessment for the ADPT system should 
include a review of the susceptibility of the system to waste, loss, 
unauthorized use, or misappropriation. '*'¥'%' 
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35-9.4.4 Software and Data Security (See MIOG, Part II, 35-13.) ^ 
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(1) All software used on FBI ADPT systems should be ."$§ : . 

obtained through authorized procurement channels.. Use of software -» 

acquired through other than appropriate procurement channels (e.g, 
public domain software, bulletin board services, personally owned 
software (developed or purchased)) is restricted, must be approved in 
writing by the SAC as an operational necessity, and must adhere to the 
applicable software licensing restrictions. Even if the software ia 
approved by the SAC, software acquired through other than the 
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appropriate procurement channels must be scanned for. malicious code • "'•" 
and used on a standalone microcomputer to maintain the accreditation 
of FBI ADPT systems. ''•.-.. 

(2) FBI microcomputers and associated ADPT storage media 
which have processed, stored or transmitted other than appropriately 
acquired software must be cleared prior to processing FBI information. 
When the software is no longer required, the software should be • 
cleared from the system. Non-FBI microcomputers and associated 
storage media which have processed, stored, or transmitted non-FBI 
software and/or information must be sanitized prior- to processing, 
storing, o r transmitti ng any FBI information (e.g., personally owned 



computer must be sanitized before it is used to process FBI 
information). The clearing and sanitization processes are discussed 
in Section 35-9.4.14. 

(3) Safeguards must be in place to detect and minimize, 
inadvertent or malicious modification or destruction of an ADPT 
system's application software, operating system software, and critical 
data files. The safeguards should achieve the integrity objectives 
and should be documented in the system security plan. Executable 
software authorized to run on an FBI ADPT system shall be identified 
in the system security plan. The level of protection must be 
commensurate with the sensitivity of the information processed. At a 
minimum, such media should, be backed-up and stored physically 
separated from the system or at an off-site location. 
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(4) Virus prevention measures commensurate with the level 
of risk identified in the risk analysis shall be employed to protect 
the integrity of the software/data. The ADPT Security Officer manages 
the virus protection program for the FBI and should be contacted for 
approved virus scanning and cleanup techniques and/or procedures if 
there is a suspected or known malicious software threat. Whenever a 
virus infection. is detected, it should be reported to the ADPT 
Security Officer. All media shall be scanned as follows: 

(a) All seized machines and media, prior to 
introduction to or use by any FBI ADPT system. 

(b) All removable magnetic media (such as floppy 
disks) entering the operational environment regardless of source, 
prior to use. 

(c) All fixed storage devices, on a periodic basis. 

(5) Use of software shall comply with copyright laws. 
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(6) To facilitate compliance with MIOG, Part II, Section 
2-9, "Grand Jury (Rule 6)," access to Rule 6(e) information via - 
electronic means must be tracked by user name, date, time, what was 
accessed, and what actions were taken. All existing Rule 6(e) 
information readily identifiable as such, and all Rule 6(e) 
information added to the system must be labeled, as discussed in 
Section 35-9.4.10, and access to it restricted and tracked, as 
discussed in Section 35-9.4.1. 
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(7) Access to SCI information must be restricted to 

_ appropriately_indoctrinated. individuals.— Access-. to_TOP_SECRET_and/or_ 
SCI information must be tracked by user name, date, time, what was 
accessed, what actions were taken. All existing TOP SECRET and/or SCI 
readily identifiable as such and all TOP SECRET and/or SCI added to 
the system, must be labeled and access to it restricted. The FBI ADPT 
Security Officer shall be contacted prior to development or operation 
of any system processing SCI. 

(8) Introduction of data from sources and/or in formats 
other than those specified in the system security plan (e.g., 
financial data received from banking institutions) must be approved in 
writing by the SAC as an operational necessity. These activities must 
be in conformance with the accreditation of the ADPT system. 



(9) In order to maintain s 
configuration management and change c 
updates to and the installation of so 
to ensure that the software functions 
historical record of software changes 
also help to ensure that only authori 
system. These controls may include a 
that grants managerial approval prior 
documents the changes. 



oftware integrity, proper 
ontrols must be used to monitor 
ftware. This process will help 
as expected and that a 
is maintained. Such controls 
zed software is permitted on the 
software configuration policy 
to software modification, then 
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Maintenance Activities (See MIOG, Part II, 35-13.) v 
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(1) Hardware and software maintenance activity may affect 
the integrity of existing protection measures or permit the 
introduction of security exposures into a system (e.g., computer 
viruses, trojan horses, logic bombs, implant devices, etc.). 

(2) All electronic storage and memory devices associated - 
with FBI ADPT systems may not be returned to the vendor for "trade-in" 
or credit purposes. Exceptions must be approved by the ADPT Security 
Officer. 



(3) Dial-up diagnostic maintenance examination of FBI 
ADPT equipment via remote communication between vendors and FBI 
facilities is prohibited. 

(4) All maintenance work performed on-site must be 
supervised by FBI personnel knowledgeable in the operation of the ADPT 
system regardless of the classification of the system or its 
associated media. On-site maintenance personnel must meet the 
personnel security requirements discussed in Section 35-9.2. Vendor 
diagnostic software used on any FBI microcomputer may not be removed 
from FBI control. Vendor diagnostic software must be scanned, write- 

| protected, and retained by the Computer Specialist. Only this copy of 
the software may be used on FBI ADPT systems. 

(5) Storage media and microcomputers with nonremovable 
ADPT storage media must only be transferred through maintenance 
channels approved by FBIHQ. Only ADPT storage media and 
microcomputers which have been sanitized and declassified, as' 
discussed in Section 35-9.4.14, can be released from FBI control for 
maintenance. 
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35-9.4.6 Portable" Microcomputers (See MIOG, Part II, 35-9.4.17' 
& 35-13.) 

(1) Portable microcomputers (e.g., laptops, notebooks) 
support the Bureau's mission but require extra attention due to the 
vulnerability that their portability creates. 
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(2) As is the case with all FBI equipment, | portable 
microcomputers | are considered nonexpendable FBI property. An FD-281 
(or FD-281a), "RECEIPT FOR GOVERNMENT PROPERTY," must be executed for 
portable microcomputers issued to an individual for an extended period 

_of_time._Por.table_micr.ocomputers_-charged-out_for_shor.ter_periods_of 

time may be accounted for by 0-96, "FBI Property Pass," or an FD-79, 
"CHARGE-OUT RECORD OF NONEXPENDABLE PROPERTY." See Manual of 
Administrative Operations and Procedures (MAOP) , Part I, 1-3, 
"GOVERNMENT PROPERTY," for details. 

(3) . To the extent possible, portable microcomputers 
should be kept in the possession of the individual to whom they are 
issued or charged out. 

(4) FBI portable (microcomputers are authorized to process 
classified information up to and including Secret/Collateral within 
the U.S. and its territories and can be connected to the FBI Secure 
Network (FBINET) . The processing of Top Secret and SCI information 
/is not authorized on portable microcomputers without written 
authorization by the FBI's SPM. | Like classified documents, | portable 
microcomputers | used to process classified information must be secured 
in locked storage when not under direct personal control. | Portable 
microcomputers should be kept in the possession of the individual to 
whom they are issued or charged out. Removable hard drives must 
always remain in the direct personal control of the individual to whom 
they are issued or maintained in a secured locked container within 
FBI-controlled space. The hard drive cannot be left unattended. 1 1 

(5) All FBI portable microcomputers are to have security 
subsystems installed which provide specific security features, 
including individual identification, authentication and access 
control, and disk encryption, as discussed in Section 35-9.3. 

(6) Use of portable ADPT systems outside U.S. territories 
must be coordinated with the ADPTSO. 



• u ■>/ <?>. 



■ ^ 



■ &$ 
-■«£ . 

■5i v 

■ .VJ?S-' 

'••'■'££:■' 
'->; if 




I (7) Removable hard drive devices used to process, store, 
or transmit National Security Information (NSI) (this includes all 
hard drives connected to the FBINET) and/or FBI sensitive information 
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cannot have communications software that supports the connection to a 
modem or any other network (LEO, Internet, etc.) without written 
authorization from the FBI ADPTSO. 

(8) Storage of FBI sensitive and/or classified 
information on removable hard drives must be kept to a minimum. The 
individual to whom they are issued or charged to will be responsible 
for ensuring information processed and stored on the removable hard 
drive is uploaded to the FBI's central record system or transferred 
to another file storage media which will be retained in controlled 
FBI space and then deleted from the hard drive. This will reduce the 
SMPJgit °f info rmation contained on the hard dri ve if the drive is ' 
lost or stolen. ~~ ~ " 
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(9) Portable microcomputers and docking stations are not 
authorized within the Criminal Informant Management System (CIMS) 
program. 

(10) Connections to non-FBI networks, and the purchase of 
FAX/MODEMS will be approved, on a case-by-case basis, by the ADPTSO. 
Portable microcomputers connected to non-FBI networks must operate as 
DEDICATED microcomputers. These portable microcomputers should not 
process any FBI sensitive information and MUST NOT process any 
National Security Information. Additional hard drives can be procured 
to support the use of FAX/MODEMS. I 
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35-9.4.7 Inventory of ADPT Systems Processing Classified 
Information 
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Computer Specialists must be able to identify all 
equipment processing, storing, or transmitting classified information, 
whether operating as part of a network or in a standalone mode of 
operation. This requirement is in addition to the hardware and 
software inventory requirements stated in MIOG, Part II, Section 16- 
18.9. 
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35-9.4.8 Telecommunications (See MIOG, Part II, 35-9.4.15 & 35-13.) •'•..'. 

(1) Unencrypted dial-up access to FBI ADPT systems is 
prohibited. <• 

(2) Connections between FBI ADPT systems and non-FBI ADPT 
systems, public or private, may only be authorized under the following : 
conditions: 

(a) Connections to non-FBI ADPT systems for law 
enforcement-related inquiries (e.g., Department of Motor Vehicles, •" IN- 



EFFECTIVE: 07/26/95 
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state or local police departments, and credit bureaus) are authorized. 

Microcomputers connected to non-FBI networks must operate as dedicated 

microcomputers. These connections should be documented locally. »Ji 

Documentation should include technical description of the connection 

and administrative approvals. 
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(b) All other connections to non-FBI networks will ~ ^W 

be approved, on a case-by-case basis, by the ADPT Security Officer. ,J§ 

For example, FBIHQ is working to provide access from FBINET to U.S.. '^ 

Customs Service, Drug Enforcement Administration, and the National %• 

Information Infrastructure (Nil). In order to ensure the security of *S| 

FBINET, these interconnections will require special security measures ' /*£■, 

such as trusted guard processors or multilevel secure systems. As '"tm 

part of the approval process, the ADPT Security Officer will ensure Jfp|, 

that the appropriate documentation, such as memoranda of ""'iW 

understanding, interconnection agreements, etc., is executed on behalf "'■"*' 

of the FBI. <^j% 
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(3) Because electronic bulletin boards may have 
constitutional expectations of privacy, a comprehensive program of 
monitoring electronic bulletin boards for criminal or intelligence . " . -/^ifc, 
purposes is prohibited. vvT^i 
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| 35-9.4.9 Classification and Controls (See MIOG, Part II, 35-13.) 

(1) ADPT systems are classified at the highest level of 
information that has been entered into, stored on, or processed by the 
system unless the system can be appropriately declassified. The ADPT 
system must be labeled, secured and operated commensurate with its' 
classification level. An exception is microcomputers with ' . 
nonremovable ADPT storage media may only store classified information 
when the SPM has granted a written waiver for fixed drive open storage 
and the system is protected with a security system that prevents 
_writing_to_the_fixe.d_driye.,_forcing_use_o.f_re»oxabie_jBedia_ J 
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(2) All ADPT storage media containing classified 
information must be labeled and secured in accordance with the 
policies for the storage of classified material stated in MIOG, Part 
II, Section 26-5 through 26-5.3. 

(3) FBI ADPT systems that store, process, or transmit 
sensitive or classified information must be operated only in space 
that is under exclusive Bureau control and under the personal control 
of authorized persons. ADPT systems, such as microcomputers, operated 
under FBI control must be adequately protected to ensure that access 
to FBI information is available only while FBI personnel are on-site. 

(4) When not under the personal control of an authorized 
person either during or outside regular working hours, FBI 
microcomputers must be secured as follows: 

(a) Microcomputers must be turned off. Exceptions 
must be approved as part of the accreditation statement. 

(b) Diskettes, tapes, removable storage devices and 
printer ribbons must be labeled and secured commensurate with the 
highest level of information ever stored on the device. 

(5) All FBI ADPT systems connected to FBINET, IISNET, and 
SAMNET are considered classified and must be appropriately labeled and 
controlled at the level of those networks. 
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(6) The FBINET subnetwork is authorized to process up to 
and including SECRET/col lateral data. Under no circumstances may TOP 
SECRET (TS) or Sensitive Compartmented Information (SCI) be processed 
by FBINET or introduced by any means into any ADPT system that is 
connected to the FBINET. To facilitate compliance with this 
restriction, all correspondence containing TS or SCI levels of data or 
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information will be "portion marked" to show specific classification 
levels (i.e., title, paragraph). Portion marking will allow for that 
information which is classified as SECRET/col lateral or below to be 
entered into ADPT systems accessed by the FBINET network. Under no 
circumstances may SCI,' regardless of classification level, be •/. 
processed on the FBINET. (See MIOG, Part II, 26-2.6.3.) 
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35-9.4.10 External Labels (See MIOG, Part II, 35-9. A. 4 & 35-13.) 

(1) |All|ADPT storage media must be marked with a 
classification and a data descriptor | label. Portable microcomputers 
are exempt from this provision. | 

(a) All systems with nonremovable ADPT storage 
devices must conspicuously display classification and data descriptor 
labels on the unit that contains the magnetic ADPT storage device. 
The monitor may also be labeled. 









(b) Removable media must be labeled with external 
markings. An exception to this policy is granted for computer center 
operations supporting a computerized tape management system that 
provides internal classification and data descriptor designations, as 
long as the media remains in FBI-controlled spaces. However, all 
magnetic media leaving FBI-controlled spaces must be labeled with the 
external classification and data descriptor labels. 

(2) Classification Labels are color-coded labels used to 
indicate the highest level of classification of information ever 
stored on ADPT storage media. The classification labels used by the 
FBI are: CLASSIFIED SCI yellow label, SF-712; TOP SECRET orange 
label, SF-706; SECRET red label, SF-707; CONFIDENTIAL blue label, SF- 
708; and UNCLASSIFIED green label, SF-710. 

(3) Data Descriptor Labels are used to identify . „' 
additional safeguarding controls related to information stored on ADPT 
storage media. They should indicate, at a minimum, the appropriate 
dissemination and control channels. These labels should also contain' 
information necessary to retrieve archived data. The data descriptor 
label is SF-711 (or equivalent). The following illustrates 
information to be inserted on the data descriptor label J as 
applicable: 
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Cb) Dissemination - Dissemination restrictions or 
handling caveats are used in conjunction with certain information to 
indicate that the information has special access or handling 
requirements. They are not classification levels. Examples include: 
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( & ) Classification - This space should contain .„ 

either one of the three classification levels: TOP SECRET, SECRET, "" ;''tf' : 

CONFIDENTIAL; or a statement that the media is either SENSITIVE or # 

UNCLASSIFIED. TOP SECRET, SECRET, or CONFIDENTIAL, and UNCLASSIFIED " ' ~ ■% 
are defined in MIOG, Part II, Section 26-2.4. 






!• Rule 6(e) Material: Rule 6(e) of the Rules 
of Criminal Procedure, "Secrecy of Proceedings and Disclosure." 

2. ORCON: Dissemination and Extraction of 
Information Controlled by Originator - May not be disseminated outside 
of the Headquarters of the receiving agency in any form, even 
extracted or paraphrased, without permission of the originator. 

3. NOFORN: Not Releasable to Foreign Nationals 
- May not be released in any form to foreign governments, foreign 
nations or non-U. S. citizens without permission of the originator. 

(c) Control - Control Channels are formal systems of 
restricted access established to protect the sensitive aspects of 
sources and methods and analytical procedures of foreign intelligence 
programs. Examples of Control Channels are: COMINT Channels (HVCCO) 
and TK Channels. 

(<0 Compartments/Code words - A Compartment ia one 
of the divisions into which Sensitive Compartment ed Information (SCI) 
is separated in order to control access, distribution, and protection. 
SCI is information requiring special Intelligence Community controls 
indicating restricted handling within present and future Community 
intelligence collection programs and their end products. A special 
access authorization is required for each compartment. Examples of 
Compartments are: SI, G, and TK. Multiple Compartments may be . 
handled within a single Control Channel. Generally, each compartment 
has one or more unique code words associated with it to identify the 
information as belonging to that compartment. Code words are 
generally classified and/or handled within specific Control Channels; 
therefore, no examples are given here. 

(e) Agency/Office, Phone, Content, and Comments - 
The balance of the items on the data descriptor label may be used to ," 
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35-9. A. 11 Manual Security Classification Reviews 



Printouts must be reviewed manually (even if the system 

_in it i a 1 ly_prin t s_the_c 1 as s i f i cat i on_l eve l)__t o_ensur.e_they_ar e 

appropriately marked with classification and control caveats. 
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35-9. A. 12 Processing Sensitive Compartmented Information 

r 

FBI ADPT operations involving SCI must be conducted in 
accordance with the provisions of Director of Central Intelligence 
Directive (DCID) No. 1/16 "Security Policy for Uniform Protection of 
Intelligence Processed in Automated Systems and Networks." ADPT 
systems used to process SCI must be housed in accredited Sensitive 
Compartmented Information Facilities (SCIFs) . A list of currently 
accredited SCIFs is maintained by the SPM. SCI must not be stored on 
nonremovable ADPT storage media, except in accredited SCIFs approved 
for the open storage of SCI. The FBI ADPT Security Officer must be 
contacted prior to the development or operation of. any system that 
will process SCI. 
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'W. 






■US'-' 
-is? 

1 

*,•';£* 

■ ' : j 




Sensitive ' 
PRINTED: 02/18/98 



"'■3S&* 









j|a 




Sensitive 



Manual of Investigative Operations and Guidelines 
Part II;.".. - r .. ........... 

=. -.■v-- > v- •••v- ■ " .■■•,.■;•> ■.*;?/- •".".* 
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, (1) ADPT equipment and storage media that has processed ' 
FBI information may only be reused (e.g., transferred to another unit) 
within FBI control systems (i.e., formal access programs, SCIF, and 
TEMPEST) after they have been cleared by FBI employees. 

(2) The following conditions must be met: 

(a) \The microcomputer or ADPT storage media remains 
labeled and secured to the highest level of information ever entered 
int.o,__sto.red jDn,_o.r_p.rACAs.sed„by_the„.devi_ce_, -__^__ 



(b) When equipment or media is reused by a new user 
group (e.g., transfer between squads), the ADPT storage media and 
nonvolatile memory devices must be cleared by the Computer Specialist. 

(c) ADPT storage media (removable and nonremovable) 
may be cleared in the field by FBIHQ approved means as defined by the 
ADPTSO and approved by the SPM. 

(3) Regardless of the clearing process, a microcomputer 
which has been used to process classified information may not be 
removed from its operational environment without the written approval 
of the ADPTSO or the SPM. The microcomputer must continue to be 
secured commensurate with the highest classification level of 
information ever entered into, stored on, or processed by the system 
until the system has been sanitized and declassified. 
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35-9.4. 14 Disposal of Computer System Media (See MIOG, Part II, 
35-9.4.4, 35-9.4.5, 35-9.4.18 S, 35-13.) 
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(1) If the equipment is to be released from the •■ ./- 
classified control system or disposed of by the FBI, it must first be 
declassified. Microcomputer equipment which has processed sensitive 
or classified information may not be released from FBI control until 
the equipment is declassified (downgraded to UNCLASSIFIED). If the 
SCMPM cannot formally declassify the microcomputer, release or 
disposal of the equipment must be through FBIHQ. The following 
conditions must be met: 
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(a) Generally, there are two ways to sanitize 
magnetic media - overwrite or degauss. Overwrite procedures designed 
to declassify media are stricter than the clearing process designed •"" 
for use where the media will remain within FBI control systems. , Both 
methods require verification that they were successful. In addition, 
technological advances in magnetic media may render certain 
techniques/procedures ineffective. Therefore, the sanitization method 
must be approved in writing by the SPM. 

(b) A microcomputer system may be formally 
-declassified_by-an_or.iginal -class if ication-authority_of_the_Division. 

after review by the Division Security Countermeasures Program Manager 
only if all the following conditions are. met: 

1. The microcomputer system does not contain 
nonvolatile memory or nonremovable ADPT storage devices. 

2. All volatile memory is sanitized by turning 
off the microcomputer. 

3. All removable ADPT storage devices and 
printer ribbons are removed. 
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FBI network. 



4. The microcomputer is not connected to any 



(c) When inoperable, diskettes, tape cartridges, 
printouts, ribbons and similar items used to process sensitive or 
classified information must be destroyed in accordance with MIOG, Part 
II, Section 26-15. 



■0. 






(d) When inoperable, hard disks used to process 
sensitive. or classified information must be sent to FBIHQ for proper 
disposal following procedures provided in MIOG, Part II, Section 
26-7.2, pertaining to mail services. 

(3) The use of and return of any demonstration systems 
from vendors must be coordinated with the ADPT Security Officer and 
the Chief, Property Procurement and Management Section, Finance 
Division. 
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35-9. A. 15 Facsimile 






(1) Sensitive and classified information should only be 
transmitted via a secure facsimile system. 






(2) Use of facsimile modems on any FBI ADPT system must 
_follow the approval pro cess defined for modems as discuss ed in Section 
35-9.4.8. 



EFFECTIVE: 07/26/95 







I I 35-9.4.16 Voice Mail Systems 



Because there are no recognized standards for voice mail 
systems, these systems have not been built to meet standard security 
specifications and are not considered to be secure systems. These 
systems are, in fact, susceptible to unauthorized access. Therefore, 
any message left on a voice mail system should contain the minimal 
amount of information possible. Do not leave any information on a 
voice mail system that, if compromised, could damage the mission of 
the FBI or endanger lives. All suspected unauthorized access attempts 
shall be reported to the SCMFM. 
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"■'•'. _■ ."'■. (1) Use of an FBI portable computer | (e.g. , laptop, 
notebook) jat home is authorized if usage is in keeping with the policy 
stated in Section 35-9.4.6. 



(2) Use of other 
or personally owned equipment) 
all FBI ADPT systems that are 
system security plan, risk ana 
standard security procedures, 

_Section_35r8.2. Al.though_it_i 

requirements, it is generally 
activities for individual syst 
to process Bureau work at home 
operational necessity. 



ADPT equipment (whether Bureau equipment. 

at home must meet the requirements for 
discussed in this policy, to include the 
lysis, contingency plan, certification, 
and accreditation as discussed in 
s__techni cal.ly__f.eas ible_t.o_addres.s_jthes_e_ 
cost prohibitive to conduct these 
ems. Therefore, use of ADPT equipment 

is actively discouraged unless it is an 



| (3) Under the following conditions, the STU-III, Type 1, 
a secure telephone unit designed specifically for the secure 
transmission of Sensitive but Unclassified and National Security 
Information, may be approved by 'the ADPT Security Staff, NSD, for the 
installation in an FBI employee's private residence located in the 
United States only. An electronic communication should be directed 
to the ADPT Security Officer, NSD, requesting approval. 

(a) The Assistant Director in Charge, Assistant 
Director, or SAC must approve, in writing, the operational need for 
the installation of a STU-III, Type 1, in the employee's residence. 

(b) STU-III, Type 1, installation is approved for 
the transmission of conversations (voice) up to, and including, Top 
Secret. No Sensitive Compartmented Information will be approved for 
transmission from a private residence. This policy does not apply to 
the transmission of data. 
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(c) When the STU-III is in an unkeyed state, the 
equipment must be protected in a manner that is sufficient to 
preclude any reasonable chance of theft, sabotage, or tampering. 
When not in use, the Crypto-Ignition Key (CIK) must be locked up or 
retained in the custody of the authorized FBI employee. The room in 
which the equipment is installed must prevent eavesdropping. In 
addition, Sensitive but Unclassified and NSI conversations must be 
held in the presence of authorized personnel only, that is, personnel 
with appropriate clearances and need to know. The STU-III must be 
installed in a room that can meet these requirements. 
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35-9.4.18 Use of Non-Bureau-Owned ADPT Systems 

(1) Use of personally owned, leased, or loaned equipment 
(e.g., equipment provided by a local police department as part of a 
JTF) to support the processing of Bureau information must meet all 
provisions of this polic y. The fo llowing_add;tinna1_rj> s f ri c.t ions 
apply: 
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(a) Under no circumstances will personally owned, 
leased, or loaner equipment or media be used to process classified 
information. 




(b) To the extent possible, information should be 
stored on FBI-owned storage media. Provisions should be made which 
allow for FBI retention of nonremovable, nonvolatile storage, device 
(e.g., microcomputer hard drives) if the device cannot be successfully 
sanitized as discussed in Section 35-9. A. 14. 

(2) For security reasons, placement and removal of 
microcomputers and related media to operational environments where 
classified information is processed must be approved by the 
responsible Security Countermeasures Program Manager or the FBI 
Security Programs Manager. 
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35-9.5 



Emanations Security (See MIOG, Part II, 35-9.3.2.) 



(1) ADPT systems, including but not restricted to 
microcomputers and communications switches, used to process classified 
information must meet national TEMPEST standards for the specific 
operational and physical environment in which they are operated. In 
many instances, these standards may be met with commercial equipment. 

(2) The Section Chief of the Technical Operations 
Section, IRD, provides policy and guidance on Technical Surveillance 
Countermeasures (TSCM) and emanations security. The Technical 
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Programs Unit conducts TEMPEST certifications. 
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(3) (Network and Information Systems Support Unit • 
(NISSU), fOMS, IRD is responsible for ensuring the provisions of NACSIM 
5203, "Guidelines for Facility Design and Red/Black Installation (U),", 
June 30, 1982 and Appendix B to NACSIM 5204, "NSA Specifications for 
RF Shielded Enclosures for Communications Equipment General 
Specifications," are met with respect to addressing. the 
telecommunications aspects of this program. | (NISSU) [defines the 
requirements, develops the specifications and conducts inspections. 
These activities are coordinated with the SPM. 
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35-9.6 Communications Security 

The FBI's ADPT security program relies on a related 
program, the communications security program, to protect 
telecommunications systems. Communications security (COMSEC) is 
defined as all measures which are taken to prevent recovery of 
information while it is being transmitted by telecommunications 
equipment. All communications circuits used to interconnect remotely 
located components of FBI ADPT systems which process, store or 
transmit classified or sensitive information require consideration of 
COMSEC measures. 
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SECURITY INCIDENTS AND VIOLATIONS 




(1) A security incident is a condition that has the 
potential to impact the security of an ADPT system, such as any 
attempt to gain unauthorized access to information, virus infection, 
or loss or theft of computer media. Security incidents may result 
from intentional or unintentional activities. ADPT security-related 
incidents should be reported to the FBI ADPT Security Officer by the 
CSSO or SCMPM, as appropriate. The FBI ADPT Security Officer will 
address the impact of the security incidents on the system's,. 
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accreditation status and recommend additional security countermeasures ' 
to reduce generic risks. In addition, DOJ requires that all malicious r 
software incidents of DOJ automated information systems, including \ 
mainframes, microcomputers, network's, or personal computers, be ", 
documented and reported. For reporting purposes, malicious software ' 
incidents include any detection of malicious software, whether 
detected on magnetic media prior to entry into an FBI ADPT system or 
after infection of the system, and any actual execution of malicious 
software. The ADPT Security Officer will maintain the appropriate 
records and fulfill the DOJ reporting requirements on behalf of the 
SPM. DOJ will use this information to determine the extent of 
problems in the De partment. 
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(2) FBI employees are subject to disciplinary action for 
violation of FBI ADPT security policy. Such violations may invoke FBI 
disciplinary action even if they are not criminally pursued. 
Reportable ADPT security-related violations are addressed in the MAOP, 
Part I, Section 13-13, "Schedule of Disciplinary Offenses and 
Penalties for FBI Employees," and should be reported as specified in 
the MAOP. Sanctions for noncompliance are also provided in the MAOP. 
It should be noted that reporting violations to the ADPT Security 
Officer does not relieve the responsibility for reporting to ASU or 
OPR, as defined in the MAOP. 

(3) Any person who knowingly, willfully, or negligently 
discloses information to unauthorized persons will be subject to the 
appropriate penalties and sanctions under the law (i.e., Privacy Act, 
Computer Fraud and Abuse Act, National Security Act, or appropriate 
espionage statutes). 

(4) Non-FBI employees who violate this policy are subject 
to having their access to FBI ADPT systems and facilities terminated. 
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35-H REGULATIONS/LAWS GOVERNING ADPT SECURITY (See MIOG, Part 
II, 35-2, 35-5.). :■ . 

(1) Title 5, U.S. Code, 552a, "Privacy Act of 1974," 
(Public Law 93-579), December 31, 1974 

(2) Title 5, Code of Federal Regulations . (CFR) , Part 930, 
Subpart C, "Employees Responsible for the Management of Use of Federal 
Computer Systems" 

(3)— Title-31,-U.S.-Code,-1105,-1113,-3512,-!!Federal^ 



Managers* Financial Integrity Act of 1982," (Public Law 97-255), 
September 8, 1982 (FMFIA) 

(4) Title 18, U.S. Code, 1030, "Computer Fraud and Abuse 
Act of 1986," (Public Law 99-474), October 16, 1986 

(5) Title 18, U.S. Code, 2701, "Electronic Communications 
Privacy Act of 1986," (Public Law 99-508) , October 21, 1986 

(6) Title 40, U.S. Code, 759, "Computer Security Act of 
1987" (Public Law 100-235), January 8, 1988 

(7) Title. 41, CFR, 201, Federal Information Resources 
Management Regulation (FIRMR) 

(8) Title 44, U.S. Code, 3501-3520, "The Paperwork 
Reduction Act of 1980" (Public Law 96-511), December 11, 1980 

(9) Department of Justice (DOJ) Order 2640. 2C, 
"Telecommunications and Automated Information Systems Security," June 
25, 1993 

(10) Department of Justice (DOJ) Order 2830. ID, "Automated 
Information Systems Policies," October 3, 1986 

(11) Department of Justice, "Simplified Risk Analysis- 
Guidelines (SRAG)," May 18, 1990 . . * 

(12) Director of Central Intelligence Directive (DCID) No. 
1/14, "Minimum Personnel Security Standards and Procedures Governing 
Eligibility for Access to Sensitive Compartmented Information," 
January 22, 1992 

(13) Director of Central Intelligence Directive (DCID) No. 
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1/16, "Security Policy" for Uniform Protection of Intelligence^ ' 7 " 
Processed in Automated Information Systems and Networks." July 19,- • 
1988 , : ; ; y. ■ .. ■-• ■ : . _ v r •„»■ 

(14) Director of Central' Intelligence Directive (DCID) No. 
1/21, "Manual for Physical Security Standards for Sensitive 
Compartment ed Information Facilities (SCIFs)," January 30, 1994 

(15) Executive Order 12958 (E.O. 12958), "National 
Security Information," April 20, 1995 

_(16)__Eederai_Inf ormation^Processing. Standards, Publicat ion, „ 



■J 'A 



FIPS PUB 65, "Guidelines for Automatic Data Processing Risk Analysis' 

(17) Federal Information Processing Standards Publication, 
FIPS PUB 87, "Guidelines for ADP Contingency Planning" 

(18) Federal Information Processing Standards Publication, 
FIPS PUB 112, "Password Usage" 

(19) Government Accounting Office. (GAO) "Policy and 
Procedures Manual for Guidance of Federal Agencies - Title II - 
Accounting" 

(20) National Security Council/Policy Coordinating 
Committee, National Security Directive 42 (NSD 42), "National Policy 
for the Security of National Security Telecommunications and 
Information Systems," July 5, 1990 

(21) National Telecommunications and Information Systems 
Security Directive (NTISSD) No. 500, "Information Systems Security 
(INFOSEC) Education, Training, and Awareness," February 25, 1993 v s,; 

(22) National Telecommunications and Information Systems 
Security Instruction (NTISSI) No. 7000, "Tempest Countermeasures for 
Facilities," November 29, 1993 ; . 

(23) National Telecommunications and Information Systems 'C 
Security Policy (NTISSP) No. 200, "National Policy on Controlled - 
Access Protection," July 15, 1987 y 

(24) National Telecommunications and Information Systems 
Security Policy (NTISSP) No. 300, "National Policy on Control of 
Compromising Emanations," November 29, 1993 

(25) NIST Special Publication 500-174, "Guide for 
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(26) Office of Management and Budget (OMB) Circular A-123, 
"Internal Control Systems," August 4, 1986 
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Selecting Automated Risk Analysis Tools," October 1989 *.^ 






(27) Office of Management and Budget (OMB) Circular A-127, ^ 
"Financial Management Systems," December 19, 1984 . "' • * ;yl 






(28) Office of Management and Budget (OMB) Circular A-130, ■'■'~'^B 

"Management of Federal Information Sources," June 25, 1993 ".ftf 



«*» 



—(29) — Office of- Management- and Budge t-(0MB)-Bul let in- <--^fe 

90-08, "Guidance for Preparation of Security Plans for Federal 
Computer. Systems that Contain Sensitive Information" 



■x.m 



(30) Department of Defense (DoD) 5200.28-STD, "Department /jf 

of Defense Trusted Computer System Evaluation Criteria" ;-!» 



(31) National Computer Security Center Technical Guide 005 
(NSC-TG-005) , "Trusted Network Interpretation of the Trusted Computer .v^ll 

System Evaluation Criteria" :#$$ 



(32) National Computer Security Information Memorandum 
(NACSIM) 5203, "Guidelines for Facility Design and Red/Black ' ^ 

Installation (U) , " June 30, 1982 1& 









(33) Appendix B to NACSIM 5204, "NSA Specifications for RF 
Shielded Enclosures for Communications Equipment General ', "•■• f *j : 

Specifications (U)" 
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35-12 GLOSSARY OF TERMS (See MIOG, Part II, 35-3.) 

(1) Access - the capability and opportunity to gain 
knowledge of, or to alter information ormaterials, including the . 
ability and means to communicate with (i.e., input or receive output),' 
or otherwise make use of any information, resource, or component in a 
computer system. &?-. 

. \i 

$M | (2) Access Control - the process of limiting access to ", 

"■)&M I the resources of a system to only authorized persons, programs, -{i- 

..... •-..-■ ■ . ■ <f>^„ 
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processes', or other systems. Synonymous with controlled access and 
limited access. , J 

(3) Accreditation - the official management authorization 
for operation of an ADPT system which provides a formal declaration by 
an accrediting authority that a computer system is approved to operate 
in a particular security mode using a prescribed set of safeguards. 
Accreditation is based on the certification process, as well as other 
management considerations. An accreditation statement affixes 
security responsibility with the accrediting authority and shows that 
proper care has been taken for security. 



(4) Accrediting Authority - the official who has the 
authority to decide on accepting the security safeguards prescribed 
for a computer system or that official who may be responsible for 
issuing an accreditation statement that records the decision to accept 
those safeguards. The Senior Executive Service personnel designated 
by the Director, FBI, are the authorized accrediting authorities. 

(5) Automated Data Processing Telecommunications (ADPT) 
System - an assembly of hardware, software, and/or firmware configured 
to collect, create, communicate, compute, disseminate, process, store, 
and/or control information in an automated fashion. An ADPT system 
must be under the same direct management control with essentially the 
same function, reside in the same environment and have the same 
characteristics and security needs. Examples of ADPT systems include, 
but are not limited to: mainframe, minicomputer, microcomputer, local 
and wide area networks, connectivity and control hardware/firmware and 
application systems. 

(6) ADPT Security - measures or controls that safeguard 
or protect an ADPT system against unauthorized (accidental or 
intentional) disclosure* modification, destruction of ADPT system and" 
data, or denial of service. ADPT system security includes 
consideration of all hardware and/or software functions, 
characteristics, and/or features; operational procedures, 
accountability procedures, and access controls at all computer 
facilities; management constraints; physical structures and devices; 
and personnel and communication controls needed to provide an. 
acceptable level of risk for the ADPT and for the data contained in 
the system. 

(7) Authorization - the privileges and permissions 
granted to an individual by a designated official to access or use a 
program, process, information, or system. These privileges are based 
on the individual's clearance and need-to-know. 
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(8) Authorized Person - a person who has the need-to-know '"- 
for classified or sensitive information in the performance of official 
duties and who has been granted a personnel security clearance or 
authorized access at the required level. The responsibility for 
determining whether a prospective recipient is an AUTHORIZED PERSON 
rests with the person who has possession, knowledge, or control of the 
classified or sensitive information involved, and not with the 
prospective recipient. 

(9) Audit Trail - a chronological record of system 

_-activities._that_enables_the-_r.econs.truction_and_examination_.of_the_ . 

sequences of events and/or changes in an event. 

(10) Authenticate - the process to verify the identity of 
• a user, device, or other entity in a computer system, often as a 

prerequisite to allowing access to resources in a system. 

(11) Availability - the property of being accessible and 
usable upon demand by an authorized entity. Required ADPT services 
must remain .available to authorized users operating within the same 
security constraints that make these services unavailable to 
unauthorized users. 

(12) Certification - the comprehensive security test and 
evaluation of the technical and nontechnical security features of a 
computer system and other safeguards, made in support of the 
accreditation process, that establishes the extent to which a 
particular design and implementation meet a specified set of security 
requirements. 

(13) Classified - any information that has been 
determined, pursuant to Executive Order 12958 or any predecessor 
order, to require protection against unauthorized disclosure and is so 
designated. \ 

(14) Clearing - the process of removing information- 
recorded on an ADPT storage media and nonvolatile memory devices. 
Clearing cannot be used to downgrade/declassify ADPT storage media or 
nonvolatile memory. Clearing can be performed in the field using.. 
FBIHQ-approved means and is used when the microcomputer and ADP? 
storage media remain in FBI control. ' . '- '-'.;.-. 
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(15) Compartmented Security Mode - an operational method 
where each user with direct or indirect individual access to a 
computer system, its peripherals, and remote terminals or hosts meets 
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(a) a valid personnel security clearance for the . : 
most restricted information in the computer system. " 

(b) formal access approval, and has signed 
nondisclosure agreements, for that information to which that user is 
to have access. 




(c) a valid need-to-know for that information to 
which that user is to have access. 





(16) Communications Security (COMSEC) - the protective 
measures taken to deny unauthorized persons information derived from 
telecommunications and ensure the authenticity of such communication. 
Communications security includes crypto security, transmission 
security, and physical security of COMSEC material. 

(17) Compromise - the disclosure of classified or 
sensitive information to persons not authorized access or having a 
need^to-know. 

(18) Compromising Emanations - unintentional signals that, 
if intercepted and analyzed, would disclose the information 
transmitted, received, handled, or otherwise processed by 
telecommunications or automated information systems equipment. 

(19) Confidentiality - sensitive data that are held in ■- 
confidence and are protected from unauthorized disclosure. FBI ADPT 
systems support a range of unclassified, sensitive and classified 
National Security Information, up to and including TOP SECRET code 
word material. .'*.'' 

(20) Configuration Management (CM) - an approach for 
specifying, documenting, controlling, and maintaining the visibility 
and accountability of all appropriate hardware, software, firmware, 
communications interfaces, operating procedures, installation 
structures, and all changes thereto. 

(21) Contingency Plan - an emergency response plan, backup, 
operations plan, and post-disaster recovery plan, maintained by an 
activity as a part of its security program, that will ensure the 
availability of critical resources and facilitate the continuity of 
operations in an emergency situation. Synonymous with disaster plan 
and emergency plan. 
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(22) Declassification - a formal statement that a l 
microcomputer system or its media is UNCLASSIFIED. 

(23) Dedicated Security Mode - an operational method when, 
each user with direct or indirect individual access to a computer 
system, its peripherals, and remote terminals or hosts meets all the 
following criteria: 

(a) a valid personnel security clearance for all 
information on the system. 



PAGE 


35 - 


66 


,'"WV n ^, 


■ t :\* " •"* 


. '*^;"i 


V • - , 


- ■*-.w*»t*-/ i > 


■ Vv.'* 









• •• -iSfewS. 

■■•-.« 

•-■•* SINKS' 



• ",*?■• 



contained within the system. 



(b) a valid need-to-know for all information 



(c) for classified systems, formal access approval, 
and signed nondisclosure agreements for all the information stored 
and/or processed (to include all compartments, subcompartments, and/or 
special access programs). 










(24) Dedicated System - a system that is specifically and 
exclusively dedicated to and controlled for a specific mission, either 
for full-time operation or a specified period of time. 






(25) Denial of Service (DOS) - the prevention of 
authorized access to resources or the delaying of time-critical 
operations. DOS refers to the inability of an ADPT system or any 
essential part to perform its designated mission, either by loss of, 
or degradation of operational capability. 

(26) Department of Defense (DoD) Trusted Computer 
System Evaluation Criteria - a document published by the National 
Computer Security Center containing a uniform set of basic 
requirements and evaluation classes for assessing degrees of assurance v „ 
in the effectiveness of hardware and software security controls built ',, 
in the design and evaluation of systems. These criteria are intended, 
for use in the design and evaluation of systems that will process"" 
and/or store sensitive or classified data. This document is also - v 
referred to as thie "Orange Book;" 

(27) Encryption - the process of transforming data to an 
unintelligible form to conceal its meaning in such a way that the . 
original data cannot be obtained without using the inverse decryption 
process. 
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(28) Environment - the aggregate of external procedures, 
conditions, and objects that affect the development, operation, and 
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(29) FBINET - The FBI Network that provides secure • 
communications for the FBI Data Network supporting classified > > 
automated applications up to the SECRET noncode word level." .' * 

(30) Identification - the process that enables recognition 
of an entity by a system, generally by the use of unique machine 
readable user names. 

(31) IISNET - the Intelligence Information System Network 
-that_,prov.ides_secure_communications_,for_the._FBI_Data_Network 

supporting classified automated applications to include TOP SECRET 
code word material. 

(32) Individual Accountability - the ability to associate 
positively the identity of a user with the time, method, and degree of 
access to a system. 

(33). Industrial Security - the management, control and 
safeguard of FBI information entrusted to contractors. 

(34) Information Security - the protection of information 
systems against unauthorized access to or modification of information, 
whether in storage, processing or transit, and against the denial of 
service to authorized users or the provision of service to 
unauthorized users, including those measures necessary to detect, 
document, and counter such threats. 

(35) Integrity - computerized data that is the same as 
those in the source documents and has not been exposed to accidental 

or malicious alteration or destruction. The information processing ,^ 
must ensure the data is accurate, timely, and complete to support the " r 
FBI's investigative, law enforcement, and administrative support ' 
requirements. Inaccurate data could lead to uninformed decisions and 
adversely impact investigations. 

..4 t '.,.•' - ' . . y * 

(36) Interconnected System - an approach in which the 
network is treated as an interconnection of separately created, "•■"■■• 
managed, and accredited computer systems. . .._... ' . # 

(37) Label - the marking of an item of information that 
reflects its security classification. An internal label is the 
marking of an item of information that reflects the classification of 
that item within the confines of the medium containing the 
information. An external label is a visible or 
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the outside of the medium or its cover that reflects the 
classification of the information resident within that particular 
medium. . , t 

(38) Least Privilege - the principle that requires each 
subject be granted the most restrictive set of privileges needed for 
the performance of authorized tasks. The application of this 
principle limits the damage that can result from accident, error,- or 
unauthorized use. 

(39) Microprocessor - a semiconductor central processing 
unit contained on a singlje^ntegrAted.-PLgcmt— chiP-«— — = 



(40) Mode of Operation - a description of the conditions 
under which a computer system functions, based on the sensitivity of 
data processed and the clearance levels and authorizations of the 
users. 

(41) Multilevel Security Mode - an operational method 
where each user with direct or indirect individual access to a 
computer system, its peripherals, and remote terminals or hosts meets 
all the following criteria: 

(a) some users do not have a valid personnel 
security clearance for all the information processed in the computer 
system. 

(b) all users have the proper clearance and have the 
appropriate formal access approval for that information to which they 
have access. 

(c) all users have a valid need-to-know for that 
information to which they have access. 

(42) Need-to-Know - a determination by the owner of 
sensitive and/or classified information that a prospective recipient 
has a requirement for access to, knowledge of, or possession of the 
information in order to perform tasks or services essential to carry 
out official duties. 

(43) Nonvolatile Memory Units - devices which continue to 
retain their contents when power to the unit is turned off (e.g., 
bubble memory. Read Only Memory - ROM). 

(44) Overwrite Procedure - process which removes or 
destroys data recorded on a computer storage medium by writing 
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patterns' of data over, or on top of, the data stored on the medium. • j ' 

(45) Password - a protected and private character string ,./\ 
used to authenticate.;** •' ■' 

''" (46) Personnel Security Clearance - an 

administrative determination, in compliance with Executive Order • 
10450, that an individual is eligible from a security point of view 
for access to classified information of the same or lower category as 
the level of the personnel clearance being granted. 

(47) P»f«nnng1 Securit y - the p r o cedu res established to 
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"ensure thatall personnel who have access to any sensitive information 
have all required authorities as well as all appropriate clearances. 

(48) Physical Security - the application of physical 
barriers and control procedures as preventative measures or 
countermeasures against threats to resources and information. 

(49) Purge - the removal of data from computer system 
storage devices in such a way that there is assurance, proportional to 
the sensitivity of the data, that the data cannot be reconstructed. 

(50) Residual Risk - the portion of risk that remains 
after security measures have been applied. 

(51) Risk Analysis - the process of identifying security 
risks, determining their magnitude, and identifying areas ^eding 
safeguards. Risk analysis is a part of the risk management process. 

(52) Risk Management - the total process of identifying, , 
controlling, and eliminating or minimizing uncertain event s that may . 
affect system resources. It includes risk analysis, cost benefit 
analysis, and effectiveness reviews. 

(53) * SAMNET - the SAMNET is the FBI's Command and Control 
Network which provides for distribution between FBI di vis ions of 
classified administrative narrative traffic to include the TOP SECRET 
code word material. • ..." 

(54) Sanitization - the technical elimination of' , />-' 
all information from ADPT storage media and nonvolatile memory devices 
so they can be formally certified as declassified by appropriate 
authorities. 

(55) Secure Configuration Control - the set of procedures 
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appropriate for "control iing changes to a system's hardware and .\ _ r * 
software structure for the purpose of ensuring that changes will not 
lead to violations of the system's security policy. 

- - ■* * , 

(56) Security Countermeasures - the protective measures 
and controls that are prescribed to meet the security requirements 
specified for a system. Those safeguards may include, but are not 
necessarily limited to: hardware , and software security features; 
operating procedures; accountability procedures; access and ' 
distribution controls; management constraints; personnel security, and 
physical structures, areas, and devices. Also called safeguards or 

_is.ec.ur_ i ty_cont r.o.l s.. _ — — — — — — — — - — 

(57) Security Requirements - types and levels of 
protection necessary for equipment, data, information, applications, 
and facilities to meet security policies. 

(58) Security Specifications - a detailed description of 
the security countermeasures/safeguards required to protect a system. 

(59) Security Violation - an event which may result in 
disclosure of sensitive or classified information to unauthorized 
individuals, or that results in unauthorized modification or 
destruction of system data, loss of computer system processing 
capability, or loss or theft of any computer system media. 

t 

(60) Sensitive but Unclassified Information - refer to 
Sensitive Information. 

(61) Sensitive Compartmented Information (SCI) 
classified information about or derived from intelligence """es, 
methods, or analytical processes that is required to be handled 
exclusively within formal access control systems established by the • 
Director, Central Intelligence (DC I). „ ,■'•••- 

(62) Sensitive Compartmented Information Facility (SCIF) 
an accredited area, room, group of rooms or installation where SCI may 
be stored, used, discussed, and/or electronically processed. y 

(63) Sensitive Information - information that requires -!. 
protection due to the risk or magnitude of loss or harm that could -. 
result from inadvertent or deliberate disclosure, modification and/or 
destruction of the information. The term includes information, the 
improper use or disclosure of which could adversely affect the ability 
of the FBI to accomplish its mission; information that, is 
investigative in nature; grand jury information subject to the Federal 

'-.<*■' _■-. .&.. -~ ' ''■ • '"•• ' '■' "' "..•>: -v'-'r . 
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Rules of Criminal Procedure, Rule 6(e), Grand' Jury Secrecy of - 
Proceedings and Disclosure; proprietary information; records about 
individuals requiring protection under the Privacy Act; information c 
not releasable under the Freedom of Information Act; and information 
which could be manipulated for personal profit or to hide the 
unauthorized use. of money, equipment, or privileges. Also referred to 
as Sensitive but Unclassified Information and Limited Official Use 
Information. 

(64) Standard Security Procedures - step-by-step security 
instructions tailored to users and operators of computer systems which 
proces s sensitive or classified information. ■ — __ _ — 

(65) Standalone System - a single user system not 
connected to any other systems. 

(66) System High Security Mode - an operational method 
where each user with direct or indirect individual access to a 
computer system, its peripherals, and remote terminals or hosts meets 
all the following criteria: 

(a) a valid personnel security clearance for alt 
information on the computer system. 

(b) a valid need-to-know for some of the information 
contained within the system. 

(c) for classified systems, formal access approval, 
and signed nondisclosure agreements for all the information stored 
and/or processed (to include all compartments, subcompartments, and/or 
special access programs) . 

(67) System Integrity - the quality that a system has when 
it performs its intended functions in an unimpaired manner, free from 
deliberate or inadvertent unauthorized manipulation of the system. 

(68) Telecommunications - the preparation, transmission, 
communication, or related processing of information (i.e., writing, ■< 
images, sounds or other data) by electrical, electromagnetic, 
electromechanical; electrooptical, or electronic means. * •,„ 
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(69) TEMPEST - short name referring to investigation;^ 
study, and control of compromising emanations from telecommunications 
and automated information systems equipment. 
Emanations.) 



(See Compromising 
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*"(70)~ Threat - the means through which a weakness can be ; . _- 
exploited to adversely affect an ADPT system, facility, network, or . 
operation. Threats can be categorized as human or environmental in. 
origin and include sabotage, espionage, natural disasters, data 
disclosure, data, destruction, hardware/software failure, etc. 

(71) Trusted Computing Base (TCB) - totality of protection ; 
mechanisms within a computer system, including hardware, firmware, and' 
software, the combination of which is responsible for enforcing a 
security policy. The ability of a trusted computing base to enforce 
correctly a unified security policy depends on the correctness of the 

_mechanisms_within-the-trusted-computing-base,_the-protection of those— 

mechanisms to ensure their correctness, and the correct input of - 
parameters related to the security policy. 

(72) Volatile Memory Units - devices which do not retain 
their contents when the power to the unit is turned off (e.g., * and ° m 
Access Memory - RAM). Volatile memory units become UNCLASSIFIED when 
the system is turned off. 

(73) Vulnerability - a potential weakness in an existing 
or planned security control environment whose exploitation may impact 
the confidentiality, integrity, and/or availability of a specific 
resource or mission. 
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COMPUTER SECURITY AWARENESS CHECKLIST 



OFFICIAL BUSINESS ONLY - FBI computer systems, both mainframes and 

microcomputers, are for official business only. You have NO 

EXPECTATION OF PRIVACY in their use. '_....,., ■ - jr^r\ 

< . ,_ ■ _ - % ■ ■ .. \ ,-- 

AUDIT OF USER ACTIVITIES - All systems transactions are subject to 
recording and routine review for inappropriate or illegal activity, 
conducted. ■ -i-^- '•• . " .' -.'-.. ' '* . ' "..'.'-.' *■ • - 

SANCTIONS - A violation of security requirements could result in 
termination of system access privileges and ■•f£ ou « p 2 i " i Pi» nar y ft . ft 
action, possibly removal. In addition, Title 18, USC, Section 1030 
provides criminal penalties for any person illegally accessing a 
government-owned or -operated computer. 
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''"'"■ .' \"' '•-■"" '■ \ 'I'l i[ PRINTED: 02/18/98 v :: &£':$i?; ■ f :.^ 



•*»■-. - 



lit 



•x-#l.' 






flit 






'If 

" "IN 
■ ■£•%&* 

■\»®IM. 






■ a MI 






•'"'04 



<-:®pgp^ 



r "-f if. "frl 






, 














.• " 




> 


t 


















"' , / t 


• ■■»> .> - ■ 

.. .** « 

. <<£ T. ■• 


,1. 


'. ■*'- 


'\ ■ '. 


■ V, 


K*#* V*. 


' .****> i 


■ <<• ■ ' .; 














-A* ■■ 


*-.^i. 






1 ^ . 


..-,". ...... 







•■*• 



- • -« nv -s ,._s, ... 

Sensitive 



)' ' • *!.-- 




"i. r~ * 



'.-.-y. 



.~v;t •" 'PAGE" 35:^ir 



^•_„L ■^Sttfof.'ti 




Manual of Investigative Operations and Guidelines 
Part • II •■**■%■• ^'vv.«;V' ;■ ; .■ ■-,!-.. ,..:--;'■ . :-\ ....... ;<? ,/■ ' 

CLASSIFICATION - A microcomputer and associated magnetic. media is ;«j 
classified at the highest level of information that has been entered 
into, stored on, or produced by the system unless the system canbe ^ 
appropriately declassified. The microcomputer must be labeled, . _ ..r 
secured, and operated commensurate with its classification level. FBIw 
PORTABLE' microcomputers | are authorized] to process classified . 

informationjup to and including Secret/Collateral within the U.S. and... 
its territories and can be connected to the FBI Secure Network " 
(FBINET). The processing of Top Secret and SCI information is not 
authorized on portable microcomputers without written _ . 
authorization | by the FBI's Security Programs Manager (SPM; . U>ee 
_MIOG ,_P_ar_t_I I ,_3.5r9_. A. 9. ). — _ — — — — — — ~ —_ 

LABELS -iRemovable ADPT|storage media must be marked with a 
classification and a data descriptor label. (Microcomputers j with 
nonremovable! ADPT| storage devices must conspicuously display a ■ 
classification and a data descriptor label on the unit that contains 
the magnetic |ADPT| storage device. (Portable microcomputers are exempt 
from this provision.} (See MIOG, Part II, 35-9.4.10.) 

STORAGE - All |ADPT| storage media must be labeled and secured in 
accordance with existing policies. 

PROTECT AGAINST DISASTER - Back up all your data files on a regular 
basis, according to your division's "END-USER AUTOMATED DATA 
PROCESSING CONTINGENCY PLAN." 

DOWNGRADING/DECLASSIFYING -JaDPT! storage media (operative and 
inoperative, removable and nonremovable) and nonvolatile memory 
devices may NEVER be downgraded or declassified in the field. 

EQUIPMENT AND MEDIA DISPOSAL - Microcomputer equipment which has^ •*■?«?,.' 
processed sensitive or classified information may not be released from 
FBI control until the equipment is sanitized and declassified. When ^ 
inoperable, diskettes, tape cartridges, printouts, ribbons, and , 
similar items used to process sensitive or classified »^r»ation must 
be destroyed as classified trash. .When inoperable, hard disks used to ■ 
process sensitive or classified information must be sent to FBIHQ for, , 
proper disposal. . (See MIOG, Part II, 35-9.4.14.) - ./ ' : - - -.-V^ ■■ 

MAINTENANCE - All maintenance must be performed only by properly 
cleared persons and must be supervised by FBI personnel knowledgeable 
in the operation of microcomputers. Vendor diagnostic software used 
on any FBI microcomputer may not be removed from FBI-controlled 
environment. All electronic, storage, and memory devices associated 
with FBI microcomputers must remain in FBI-controlled space and may ,; . 
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never be returned to the vendor for "trade-in" or credit Ptoses. 
I I ADPT| storage media and microcomputers with nonremovable |ADPT| storage 
media must be transferred for off-site maintenance only through FBIHQ ^ 
control channels. (See MIOG, Part II, 35-9.4.5.) 

PHYSICAL CONTROL - FBI microcomputers which process sensitive or 
classified information must be operated only in FBI-controlled space 
and under the direct supervision of authorized persons. When not 
under the direct supervision of an authorized person either during or 
outside regular working hours, FBI microcomputers must be: turned 
off: diskettes, tapes, removable hard disks, and printer ribbons must 

P e^abeUd,^emojLed,_and_secuj_ed_^_J^^ — 

llADPTlstorage media and nonvolatile memory devices operated m areas 
that are not|staffed|24 hours a day (e.g., resident agencies, off- 
sites) must not be used to process or store classified information. 
To the extent possible, PORTABLE microcomputers should be kept in the 
possession of the individual to whom they are issued or charged out. 
PORTABLE computers which must be left unattended for any amount of 
| time -must be properly secured. (See MIOG, Part II, 35-9.4.6.; 

SOFTWARE CONTROLS - All software used on FBI microcomputers must be 
obtained through either: the Operations Management Section, 
Information Resources Division, FBIHQ, or appropriate FBI procurement 
channels. 

INTRODUCTION OF NON-FBI DATA - Introduction of non-FBI data (e«g-« 
transcripts from United States Attorneys, information from Joint Task 
Force agencies) must be approved in writing by the SAC as an 
operational necessity, and all magnetic media must be scanned for 
viruses prior to use. (See MIOG, Part II, 35-9.4.4.) 

SENSITIVE COMPARTMENTED INFORMATION (SCI) - FBI ADPT operations . 
involving SCI. must be conducted in accordance with the provisions of 
Director of Central Intelligence Directive (DCID) No. 1/16, "Security 
Policy for Uniform Protection of Intelligence Processed m Automated 
Systems and Networks." 

TEMPEST - A microcomputer used to process classified information must 
meet national TEMPEST standards. FBIHQ provides. TEMPEST :. 
certifications. Any change to the approved configuration,, including 
internal components or external devices, or relocation of the ; ^ 
microcomputer invalidates the TEMPEST certification, - 

TELECOMMUNICATIONS -. Unencrypted dial-up access to FBI information 
systems or networks is prohibited. FBI microcomputers must not be 
connected to any non-FBI network, public or private. All 
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:/; microcomputers connected to the Integrated Digital. Communications 

System (IDCS) (formerly the Computer Applications Communications^ ■••; 

Network (CACN)), are* considered classified and must be appropriately 

*■ labeled. Exception, may only by granted by the FBIHQ ADPT Security 

'*-' Officer. (See MIOG, Part II, 35-9.4.8.) . ^ ■ ;_■ ^V' v ;^i > 

-■;•- ...:>.-;-s 4 r : . ' t --;•;■• ;.v . r^;^:'''-;::-.;.^ " "'■ ■ ; ; '"...'■■.■ 

BULLETIN BOARDS - A comprehensive program of monitoring electronic .^ 
bulletin boards for criminal or intelligence purposes is prohibited. 
Any access to non-FBI electronic bulletin boards is severely 
restricted. (See MIOG, Part II, 35-9,4.8.) 

MAINFRAME ACCESSORJD»_AOT_PAS.SSfflRI£_riJU.«h^ 
"""accessor ID for identification and a unique password to be used for 

authentication. Accessor IDs may be publicly known, passwords must be 
kept secret. It is your responsibility to protect your password. 
Passwords serve as an "electronic signature" on all system 
transactions for which they are used. You will be held responsible if 
someone else uses your password in connection with a system 
transaction. 

Your password is for your use only. Lending it to someone 
else is a security violation and may result in disciplinary action 
against both parties. 

Never disclose your password to anyone. Memorize it; do 
not put it in writing. Safeguard it. .Your password is the key to one 
of the FBI's most valuable resources. 

If you forget your password, notify your Computer 
Specialist. Your old password will be deleted from the system and a 
new one issued. , .. , .-...*.*.. 

Immediately following a suspected or known compromise of a' 
system password, a new password will be issued and the compromised •*,_.. 
password deleted from the system. y 

; ~* When a system user no longer needs access, the password 

will be removed from the system; ; .■"'.*; 

' .. - • :~rS, ..'.. .'■-. -• -'- '■'"■ ■>■ ' ■' •■'* ■ '•• •'■ ■* *''""■' 

:•< ' if you leave the terminal unattended for any reason, log 
'off. An unattended terminal is vulnerable to masquerading. Any user 
signed on to a terminal which has been inactive for. a period of 30 - 
minutes will be automatically signed off. You must reidentify 
yourself by reestablishing the session. (See MIOG, Part II, *>_ 
9.4.2.) 
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REPORT SECURITY VIOLATIONS - If you become aware'of any violation of ■ , 
these requirements or suspect that your password may have been used by 
someone else, it is your responsibility to report that information ... 
immediately to your respective Division Security Officer, field office 
or FBIHQ Computer Specialist. . "-£•;". ' ' 

If you have any questions about the proper operation or security of 
computer systems entrusted to you, contact a field office or FBIHQ 
Computer Specialist or Division Security Officer. 
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35-13.1 Notice of Responsibilities and Computer Security Awareness 
Certification (See MIOG, Part II, 35-8.3) 

You have been entrusted with the management, operation, or 
use of a Federal Bureau of Investigation (FBI) computer system 
processing sensitive and/or classified information. Both you and the 
FBI have responsibility pursuant to the Computer Security Act of 1987 
to protect sensitive information and under 28 CFR, Part 17, to protect 
classified information. Specific, responsibilities are set forth in 
Manual of Investigative Operations and Guidelines (MIOG), Part II, 
Section 16-18, "FBI MICROCOMPUTER POLICY;" MIOG, Part II, Section 35, 
"FBI AUTOMATED DATA PROCESSING AND TELECOMMUNICATIONS SECURITY - 
POLICY;" and in MIOG, Part II, Section 26, "CLASSIFIED NATIONAL 
SECURITY INFORMATION AND MATERIAL." At a minimum, you must follow the 
attached security awareness checklist as a basic guide and reminder of 
your responsibilities to protect the information processed and/or 
stored in the computer system (s) entrusted to you. For additional 
information about computer security, contact the field office 
|or|FBIHQ Computer Specialist or Division Security Officer. .: -t.-y , 

" I*'' certify that I have read, understand, and shall comply 

with the practices and requirements of the preceding notice and the.'- 

attached FBI Computer Security Awareness Checklist. ..■■"'•'•. \,-V 

'",*: ^"'C''. *"'';kS;.. : ;; .-,•,'.■' '•■ '•'*• '■■■■- •""' ■■' • - ..-''' ■-• 

■•)?£-,■.*■•;■'* ■■■;■ '-\ '"- ;•/.*. ■ - ■••■ . •. J „ -...,...„,•" • .. 



Signature 



Date 
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135-13.2 Nondisclosure Agreement for Joint Task Force/Contractor 
Members (FD-868) (See MIOG, Part II, 35-9.4.1.) 



..FD=868_(8=Jfc9.7)_ 
(FBI SEAL) 



U.S. Department of Justice 
Federal Bureau of Investigation 









Washington, D.C. 20535 



NONDISCLOSURE AGREEMENT FOR JOINT TASK FORCE/CONTRACTOR MEMBERS ,. 

AN AGREEMENT BETWEEN : , -^ THE FBI 

(Name of Individual-Printed or Typed) 

As consideration for assignment in the Federal Bureau of 
Investigation (FBI), United States Department of Justice, jnd as a 
condition for continued assignment, I hereby declare that I intend to 
be governed by and I will comply with the following provisions: . 

1 That I am hereby advised and I understand Federal Law, including 
statutes, regulations issued by the Attorney General and Orders of ; 
the President of the United States, prohibit loss, misuse or ■ . 
unauthorized disclosure or production of information in the files ot 
the FBI. ._*'/-... ." ' ' .','-■; ^ ' ,. ' ' " - ■ - ^<;-*.»~ 

2. I understand' that unauthorized disclosure of information in the 
files of the FBI or information I may acquire' as a Task -yy v- 
Force/Contractor employee of the FBI could result in impairment of-., 
national security, place human life in jeopardy, or result in denial ; 
of due process to a person or persons who are subjects of anTBI ,, ; , ., 
investigation, or prevent the FBI from effectively discharging its - 
responsibilities. I understand the need for this secrecy agreement, 
therefore, as consideration for assignment, I agree that I will never 
divulge, publish, or reveal either by word or conduct, or by other 
means of disclosure to any unauthorized recipient without official 

"<-■•'.-.: ■ "' ,: vv.-.. ...• ;i ■'•-••■"■ < ; ^||^^ 
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